CVE-2026-21255
Published: 10 February 2026
Summary
CVE-2026-21255 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-21255 is an improper access control vulnerability (CWE-284) affecting Windows Hyper-V. Published on 2026-02-10, it enables an authorized attacker to bypass a security feature locally. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this vulnerability with low attack complexity and no user interaction required. Exploitation changes scope to high (S:C), allowing the attacker to achieve full control over the Hyper-V environment, potentially compromising the hypervisor and hosted virtual machines.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21255 provides details on mitigation and available patches for addressing this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7328
Vulnerability details
Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in Hyper-V enables local privilege escalation (T1068) and guest-to-host escape (T1611) to fully compromise the hypervisor.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper access control flaw in Windows Hyper-V through timely application of vendor patches as detailed in Microsoft's update guide.
Implements a reference monitor for complete mediation of access decisions, tamper resistance, and verifiability, directly countering the access control bypass in Hyper-V.
Enforces approved authorizations for logical access to Hyper-V resources, addressing the core improper access control vulnerability exploited by local low-privilege attackers.