Incorrect authorization in Microsoft Windows and Windows Server - CVE-2026-83766

Vulnerability details

The vulnerability allows a remote privileged user to bypass extended access control lists and other Windows security feature checks.

The vulnerability exists due to incorrect authorization in the Windows Hyper-V virtual machine switch when using virtual networking in Hyper-V Network Virtualization (HNV) over an adjacent network. A remote privileged user can exploit the authorization flaw to bypass extended access control lists and other Windows security feature checks.

Successful exploitation requires a deep understanding of the system and depends on factors such as the environment, system configuration, and additional security measures.

Affected software

How to mitigate CVE-2026-83766

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-83766
• https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v-virtual-switch/create-security-policies-with-extended-port-access-control-lists

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows