CVE-2026-57092 is a use-after-free in Windows VMSwitch — the virtual network switch behind Hyper-V. It scores 9.9 because it breaks out of its security boundary. If you run Hyper-V, patch it.
Virtualization security has one golden rule: what happens in a VM stays in the VM. CVE-2026-57092 breaks that rule. It's a 9.9 use-after-free in Windows VMSwitch — the virtual network switch that Hyper-V uses to connect virtual machines — and it lets a low-privileged attacker escalate privileges across the virtualization boundary. That near-perfect score isn't inflation: the 'Scope: Changed' flag means the exploit escapes its container and affects the broader host, which in a hypervisor is the nightmare scenario. If you run Hyper-V anywhere, this is a patch that matters more than its 'authenticated' prerequisite suggests.
0.0/ 10
CVSS severity: Critical
Use-after-free that escapes the virtualization boundary (Scope: Changed) — a VM-escape-class hypervisor flaw.
Why a hypervisor bug is worse than its category suggests
VMSwitch runs in the privileged host partition and mediates network traffic for every VM on the box. A use-after-free there, reachable from a guest, is the kind of flaw that turns 'attacker owns one VM' into 'attacker owns the host and every other VM on it.' In multi-tenant or cloud-like environments, that collapses the isolation the whole architecture depends on. The 'low privilege required' prerequisite sounds like a mitigating factor, but in practice an attacker who has compromised a single guest VM already has exactly that — so the barrier is lower than it reads. This is the same reason edge and infrastructure components get patched first: the blast radius is the whole environment, not one machine.
VMSwitch sits in Hyper-V's privileged host partition — a flaw there threatens every VM on the machine, not just one. · Unsplash
What to do
Apply the July 2026 security update to all Hyper-V hosts running Windows 10, 11 or Server 2012–2025.
Prioritise multi-tenant and cloud-adjacent hosts, where a VM escape has the largest blast radius.
Keep guest VMs patched and least-privileged — the exploit needs a foothold, so harden the guests too.
Monitor Hyper-V hosts for unusual privilege changes and inter-VM traffic anomalies.
Quick answers
Do I need to worry if I don't run Hyper-V?
The vulnerability is in the VMSwitch component that Hyper-V uses, so the primary risk is to systems running Hyper-V — servers, but also Windows 10/11 machines with Hyper-V or features that depend on it (like WSL2 or Windows Sandbox) enabled. If Hyper-V and its virtual switch aren't in use, your exposure is lower, but the July update is worth applying regardless since it's part of the broader security rollup.
Why is it 9.9 and not 9.8?
The extra tenth comes from the CVSS 'Scope: Changed' flag combined with the impact metrics. Scope: Changed means the exploit doesn't just affect the vulnerable component — it crosses a security boundary to affect the wider system, which in a hypervisor means escaping the VM to the host. That boundary-crossing is what makes hypervisor bugs so severe and pushes the score to the very top of the scale.
Is it being exploited?
There's no confirmation of in-the-wild exploitation at disclosure, but a 9.9 VM-escape-class flaw is high-value for attackers targeting virtualized and cloud environments. Given the blast radius — a single compromised guest potentially owning the host and its neighbours — treat it as a priority patch for any Hyper-V deployment rather than waiting for exploitation reports.
For anyone running Hyper-V, this is the July bug to prioritise: a use-after-free that escapes the VM boundary is exactly what virtualization security exists to prevent. Patch your hosts. Sources: NVD and Rapid7. It sits alongside the WebLogic and RDP criticals from the same window.
