CVE-2026-57092

Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. Fixed versions are out.

CVSS 3.19.9Critical EPSS percentile60th0.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products8 fixed builds listed below

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 1607Affected: ≥ 10.0.14393.0, < 10.0.14393.9339Upgrade to: 10.0.14393.9339Affected: ≥ 10.0.17763.0, < 10.0.17763.9020Upgrade to: 10.0.17763.9020Affected: ≥ 10.0.19044.0, < 10.0.19044.7548Upgrade to: 10.0.19044.7548Affected: ≥ 10.0.19045.0, < 10.0.19045.7548Upgrade to: 10.0.19045.7548Stated by: CVE record
Microsoft Windows 11 Version 24H2Affected: ≥ 10.0.26100.0, < 10.0.26100.8875Upgrade to: 10.0.26100.8875Affected: ≥ 10.0.26200.0, < 10.0.26200.8875Upgrade to: 10.0.26200.8875Affected: ≥ 10.0.28000.0, < 10.0.28000.2525Upgrade to: 10.0.28000.2525Stated by: CVE record
Microsoft Windows Server 2016Affected: ≥ 10.0.14393.0, < 10.0.14393.9339Upgrade to: 10.0.14393.9339Stated by: CVE record
Microsoft Windows Server 2019Affected: ≥ 10.0.17763.0, < 10.0.17763.9020Upgrade to: 10.0.17763.9020Stated by: CVE record
Microsoft Windows Server 2022Affected: ≥ 10.0.20348.0, < 10.0.20348.5386Upgrade to: 10.0.20348.5386Stated by: CVE record

Versions as the sources state them. 3 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Windows device is affected by comparing its current OS build/version to the fixed versions listed by Microsoft for CVE-2026-57092.
Install the latest available Windows security updates that include the fix for CVE-2026-57092.
Verify the update applied by confirming the OS build now matches or exceeds the fixed version for your edition (Windows 10/11 or the relevant Windows Server release).
If you cannot patch right away, restrict network access to the affected host as tightly as possible until the fix is installed.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

In plain language

Written by AI from the record

CVE-2026-57092 is a serious Windows networking flaw that can let an authorized attacker remotely gain higher system privileges; most small businesses should treat it as urgent if their Windows machines are reachable over a network and an attacker already has some access.

CVE-2026-57092 is a use-after-free elevation of privilege in Microsoft Windows VMSwitch that allows a remotely connected, authorized attacker to elevate privileges without user interaction.

If you're affected

Full system takeover
Malware running with admin rights
Network disruption and downtime
Data theft at elevated access

What is it

Windows VMSwitch is part of Windows that helps network connectivity work correctly for virtualized networking. In this vulnerability, a mistake in how memory is handled can be abused by someone who already has some authorization to get much higher control over the device—potentially turning into a full system compromise.

Who is affected

This matters if you run supported Windows desktops or servers (Windows 10, Windows 11, and the listed Windows Server versions). The risk is primarily for systems an attacker can reach over the network, and it requires the attacker to be authorized and connected; there’s no need for you to click anything.

How urgent is it

This is RED because it allows privilege escalation remotely in Windows VMSwitch, meaning an attacker who has some level of authorization can gain significantly higher control without user interaction. While no clear public dated exploitation report or public exploit code is shown in the findings, the impact is critical and Microsoft has released fixes for many OS branches.

What to do — in detail

Identify affected OS and current build
- For each Windows machine (Windows 10, Windows 11, or the listed Windows Server editions), record the current version/build.
- Compare it against Microsoft’s fixed versions for CVE-2026-57092.
Determine the correct fixed version for your edition
- Windows 10 is fixed in:
  - 10.0.14393.9339
  - 10.0.17763.9020
  - 10.0.19044.7548
  - 10.0.19045.7548
- Windows 11 is fixed in:
  - 10.0.26100.8875
  - 10.0.28000.2525
- Windows Server is fixed in:
  - Windows Server 2012: 6.2.9200.26226
  - Windows Server 2012 R2: 6.3.9600.23291
  - Windows Server 2016: 10.0.14393.9339
  - Windows Server 2019: 10.0.17763.9020
  - Windows Server 2022: 10.0.20348.5386
  - Windows Server 2025: 10.0.26100.33158
Patch
- Install the Microsoft security update that includes CVE-2026-57092 using normal Windows Update / your standard patch process.
- Use Microsoft’s MSRC update guide as the authoritative reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092
Verify
- After reboot, re-check the OS build/version.
- Confirm it is at or above the fixed build for your exact edition.
If patching is delayed (temporary containment)
- Restrict network reachability to the server/workstation hosting the vulnerable Windows components.
- Reduce exposure from untrusted networks (tight firewall rules, limit inbound access paths) until patching is complete.
What to monitor
- Since this is an elevation-of-privilege issue, watch for suspicious admin-level activity on the host after any remote connection from authorized accounts.
- Review relevant security logs as part of your usual incident-monitoring process.

Technical context

Severity is critical (high impact: privilege escalation across confidentiality, integrity, and availability). The weakness is CWE-416 (use-after-free). The attack is network-based and does not require user interaction. The findings specify that an attacker must be authorized and connected over a network to exploit it. No KEV listing was found for this CVE, and there is no clear dated press claim or public exploit code provided in the findings. Exploit maturity appears limited to patching guidance at this time (no public exploit code on record), but the presence of fixed versions across many Windows branches and the critical impact make this a high-priority remediation target.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-17Analysis publishedMicrosoft's biggest Patch Tuesday ever: what I'd actually fix firstpatch available, record updated
2026-07-16OpenVAS check addedrecord updated
2026-07-15Analysis publishedHyper-V's VMSwitch use-after-free: a guest VM that walks out onto the host (CVE-2026-57092)
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable