CVE-2026-57092Patch(microsoft / windows_10_1607)

HIGHCVSS 9.9 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092

Weakness type (CWE)

CWE-416

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
10 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 10 signals
General: 2 classified signals
Peaked 5d ago at 2 mentions (2026-07-22); latest day: 1
10 total mentions across 9 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016windows_server_2019

2 versions affected across 12 products

Deep dive

Activity timeline10 mentions / 9d

Signal classification5 categories

Patch

550.0%

General

220.0%

Active Exploitation

110.0%

PoC

110.0%

Disclosure

110.0%

Referenced assets22 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-07-20	1	Patch1
2026-07-21	1	Patch1
2026-07-22	2	Active Exploitation1General1
2026-07-25	1	Patch1
2026-07-27	1	PoC1
2026-07-28	1	Disclosure1
2026-08-04	1	Patch1
2026-08-10	1	General1

Full discourse10 posts

SecEngCyGy@snypet8672d
Patch
July PT highest score: VMSwitch CVE-2026-57092 (CVSS 9.9). Use-after-free lets a low-priv guest elevate on the Hyper-V host via crafted VMSwitch traffic (scope changed). Patch Hyper-V hosts (Jul 14 updates); reboot if needed. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092 #CVE
Post summary
Microsoft has issued a July 14 update to patch a high‑severity CVE‑2026‑57092 use‑after‑free vulnerability in Hyper‑V VMSwitch, recommending a reboot afterward; no PoC or active exploitation is reported.
0001040
23 followersView on X
كاسبر سكاي@KasperskyDev82d
Patch
ثغرة حرجة في مكوّن الشبكة بالمحاكي الافتراضي تُتيح الهروب من الجهاز الوهمي إلى المضيف. المعرّف : CVE-2026-57092 درجة الخطورة : 9.9 (CVSS) - Critical المكوّن : VMSwitch — Hyper-V الحل : July 2026 Patch Tuesday #HyperV #CVE202657092
Post summary
Critical CVE‑2026‑57092 affecting Hyper‑V's VMSwitch component; a patch is scheduled for July 2026 Patch Tuesday.
01000198
39.9K followersView on X
IntegSec@integ_sec65d
General
CVE-2026-57092: Windows VMSwitch Use-After-Free Privilege Escalation - What It Means for Your Business and How to Respond https://hubs.li/Q04svLyN0
Post summary
The article outlines the Windows VMSwitch use-after-free privilege escalation CVE-2026-57092, discussing its implications for businesses and recommended response actions, but does not provide exploit details, PoC, or patch information.
0000041
32 followersView on X
Dawam Longmun Reuben@longmundawam79d
Disclosure
CVE-2026-57092, a Microsoft Windows VMSwitch elevation-of-privilege bug with a 9.9 CVSS score, is a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary #CyberSecurity #Cloud9CyberTech #AWS #CloudComputing #EthicalHacking #AI https://t.co/8xG6MmflP2
Post summary
The tweet announces CVE‑2026‑57092 as a high‑severity use‑after‑free elevation‑of‑privilege flaw in Microsoft Windows VMSwitch, mentioning its technical nature and CVSS score but providing no PoC, exploit code, or patch information.
0000049
54 followersView on X
ThreatAft@ThreatAft80d
PoC
🚨 Windows VMSwitch EoP — CVSS 9.9 CVE-2026-57092: Guest VM → Host compromise via use-after-free in Hyper-V VMSwitch. Affects Windows 10/11 & Server 2012-2025 with Hyper-V. → http://threataft.com/articles/windows-vmswitch-cve-2026-57092 #cybersecurity #infosec #Microsoft #HyperV #ThreatIntel
Post summary
The post announces a severe Windows VMSwitch elevation‑of‑privilege vulnerability and provides a link to an article that likely contains a PoC, but no exploit code, active attacks, or patch information is disclosed.
0000063
35 followersView on X
BT Haberler@BTHaberler85d
Active Exploitation
Microsoft tarihinin en büyük Patch Tuesday'i: 622 açık, 3 sıfır gün, 2'si zaten aktif saldırıda! Temmuz güncellemesinde CVE-2026-56164 (SharePoint), kimlik doğrulaması gerektirmeden kritik işlevlere erişim sağlayarak aktif olarak istismar ediliyor. CVE-2026-56155 (AD FS) ise yetki yükseltmesi için gerçek saldırılarda tespit edildi. • CVE-2026-57092: Windows VMSwitch'te CVSS 9,9 uzaktan kod yürütme; CVE-2026-50522: SharePoint'te CVSS 9,8 kritik açık. • CVE-2026-50661: BitLocker korumasını atlıyor ama fiziksel erişim gerektiriyor, henüz istismar edilmedi. • Microsoft artık MDASH adlı yapay zeka sistemini açık tarama sürecine entegre etti — Windows ikili dosyalarını analiz edip potansiyel açıkları test ediyor. Şirket, aylık açık sayısının artmaya devam edeceğini açıkça söylüyor — SharePoint kullanan kurumlar bu ay güncellemeyi ertelememeli! #SiberGüvenlik #Microsoft #PatchTuesday
Post summary
Microsoft’s Patch Tuesday revealed 622 CVEs, including three zero-days, two of which are already being exploited—particularly CVE-2026-56164 and CVE-2026-56155—while urging prompt patching and outlining technical details and CVSS scores.
0000074
36 followersView on X
Jan Guldentops@JanGuldentops85d
General
Alle individuele kwetsbaarheden uit de post met hun rechtstreekse link naar de European Vulnerability Database (EUVD) van ENISA: Active Directory Federation Services privilege escalation (CVE-2026-56155): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56155 BitLocker encryptieomzeiling (CVE-2026-50661): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-50661 Remote Desktop kwetsbaarheid (CVE-2026-56190): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56190 Hyper-V virtual machine escape (CVE-2026-57092): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-57092 Cisco VoIP kwetsbaarheid (CVE-2026-20150): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20150 Cisco SD-WAN kwetsbaarheid (CVE-2026-20182): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20182 Google Chrome bug 1 (CVE-2026-6811): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6811 Google Chrome bug 2 (CVE-2026-6812): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6812 Google Chrome bug 3 (CVE-2026-6813): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6813 Curl kwetsbaarheden range (CVE-2026-22834 t/m CVE-2026-22851): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-22834 Fortinet FortiSandbox securitylek 1 (CVE-2026-25089): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-25089 Fortinet FortiSandbox securitylek 2 (CVE-2026-39808): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39808 SonicWall SMA1000 server-side request forgery (CVE-2026-15409): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15409 SonicWall SMA1000 code injection en privesc (CVE-2026-15410): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15410 WordPress zero day (CVE-2026-63030): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-63030 Linux Kernel ip6_tunnel RCE ( CVE-2026-43037) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43037 • • Linux kernel XFRM IPSEc ESP bug ( CVE-2026-43284 ) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43285
Post summary
The post lists numerous CVE identifiers with direct links to EUVD entries, providing descriptive labels but no PoC, exploit code, patches, or evidence of active exploitation.
00000171
1.9K followersView on X
SecAlerts@SecAlertsCo86d
Patch
🪟 CVSS 9.9: CVE-2026-57092 hits Windows VMSwitch via use-after-free, letting an authorized attacker escalate privileges over the network. Affects Win10, Win11, Server 2012-2025. Patch is out — apply it. #Windows #CyberSecurity https://secalerts.co/vulnerability/CVE-2026-57092?utm_campaign=x https://t.co/XpnhUUg7eT
Post summary
The message focuses on notifying users of a high‑severity Windows VMSwitch vulnerability (CVE‑2026‑57092) and urging the installation of the available patch rather than describing an exploit or evidence of active attacks.
00000106
867 followersView on X
CyperZaX@cyperzax86d
Patch
Patch Tuesday tip: July's Microsoft update fixes 622 flaws (a record), including CVE-2026-57092 — a 9.9-severity Hyper-V VMSwitch bug that escalates to full host compromise across a VM boundary. If you run virtualization, this one jumps the queue. #CyberSecurity #InfoSec
Post summary
The post announces Microsoft’s July Patch Tuesday update includes a fix for CVE‑2026‑57092, a critical Hyper‑V VMSwitch flaw that can lead to full host compromise across a VM boundary.
0000037
8 followersView on X
Windows Forum@windowsforum91d
Patch
🪟 Hyper-V admins, patch now: CVE-2026-57092 scores 9.9 and can turn a shared VM host into a privilege-escalation playground. Virtualization is great—until one guest eyes the keys. https://windowsforum.com/threads/cve-2026-57092-patch-hyper-v-vmswitch-privilege-escalation.438819/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurityUpdates #Cve202657092 #HyperV #VirtualMachineSecurity https://t.co/4RzyJApqv0
Post summary
The tweet announces a high‑severity Hyper‑V vulnerability and urges administrators to apply the available patch immediately.
0000045
1.2K followersView on X

CPE platform detail22 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

22 of 22 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	x64
OS	microsoft	windows_server_2019	-	-	x64
OS	microsoft	windows_server_2022	-	-	x64
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-57092

SecEngCyGy[verified]@snypet86Patch

Microsoft has issued a July 14 update to patch a high‑severity CVE‑2026‑57092 use‑after‑free vulnerability in Hyper‑V VMSwitch, recommending a reboot afterward; no PoC or active exploitation is reported.

IntegSec[verified]@integ_secGeneral

The article outlines the Windows VMSwitch use-after-free privilege escalation CVE-2026-57092, discussing its implications for businesses and recommended response actions, but does not provide exploit details, PoC, or patch information.

BT Haberler[verified]@BTHaberlerActive Exploitation

Microsoft’s Patch Tuesday revealed 622 CVEs, including three zero-days, two of which are already being exploited—particularly CVE-2026-56164 and CVE-2026-56155—while urging prompt patching and outlining technical details and CVSS scores.

Jan Guldentops[verified]@JanGuldentopsGeneral

The post lists numerous CVE identifiers with direct links to EUVD entries, providing descriptive labels but no PoC, exploit code, patches, or evidence of active exploitation.

Windows Forum[verified]@windowsforumPatch

The tweet announces a high‑severity Hyper‑V vulnerability and urges administrators to apply the available patch immediately.

كاسبر سكاي@KasperskyDevPatch

Critical CVE‑2026‑57092 affecting Hyper‑V's VMSwitch component; a patch is scheduled for July 2026 Patch Tuesday.

Dawam Longmun Reuben@longmundawamDisclosure

The tweet announces CVE‑2026‑57092 as a high‑severity use‑after‑free elevation‑of‑privilege flaw in Microsoft Windows VMSwitch, mentioning its technical nature and CVSS score but providing no PoC, exploit code, or patch information.

ThreatAft@ThreatAftPoC

The post announces a severe Windows VMSwitch elevation‑of‑privilege vulnerability and provides a link to an article that likely contains a PoC, but no exploit code, active attacks, or patch information is disclosed.