Skip to content
Back to search

CVE-2026-40402

CRITICAL
9.3NVD

Summary

generated automatically from NVD data

CVE-2026-40402 is a use-after-free flaw (CWE-416) in Windows Hyper-V that lets an unauthorized attacker elevate privileges locally. The affected products include Windows 11 23H2 and Windows Server 2022, with NVD bounds of 10.0.22631.7079 and 10.0.20348.5074 respectively. It is rated CRITICAL with a CVSS v3.1 score of 9.3, and the vector shows a changed scope with high impact on confidentiality, integrity and availability.

NVD description

Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.

Share:

EPSS · FIRST.org

0.36%probability of exploitation in the next 30 days

Higher than 28% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

9.3
/ 10.0
CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Information

Published
12 mai 2026
Updated
17 juin 2026
Status
Analyzed
Source
secure@microsoft.com

Affected products

microsoft windows 11 23h2
Versions : 10.0.22631.7079
microsoft windows server 2022All Windows Server CVEs →
Versions : 10.0.20348.5074

Weaknesses (CWE)

CWE-416

References (1)

Similar CVEs

Other vulnerabilities of type CWE-416

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring