Loading story…
Check Point Research disclosed a Reverse RDP attack path affecting Microsoft Hyper-V in which a malicious guest virtual machine can exploit the host through the virtualization platform’s remote display and management channel. The issue showed that trust can be inverted in virtualized environments: instead of the host safely administering a VM, a crafted VM can target the host system during connection handling and potentially achieve code execution across the guest-to-host boundary.
The finding highlighted a serious risk for enterprises that use Hyper-V to isolate workloads, because administrators or automated systems connecting to untrusted or compromised VMs could expose the underlying host. The research underscored the need to treat VM console and management interfaces as part of the attack surface, apply Microsoft security updates, and avoid assuming that virtualization alone prevents hostile guest systems from reaching privileged host components.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published a report titled "Reverse RDP Attack: The Hyper-V Connection," disclosing technical details of the attack scenario involving Hyper-V and RDP. No earlier or additional discrete events are provided in the reference content.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **Windows Hyper-V elevation of privilege vulnerabilities** tracked as `CVE-2022-21901`, `CVE-2023-36427`, `CVE-2024-43624`, and `CVE-2025-54098`. The advisories identify a recurring security issue affecting Hyper-V components, including one flaw specifically tied to **Hyper-V Shared Virtual Disk**, with each entry published through Microsoft's Security Update Guide and related advisory portals. The vulnerabilities could allow attackers to gain higher privileges on affected Windows systems running Hyper-V, increasing the risk to virtualized environments and hosts that rely on Microsoft's hypervisor stack. Organizations using Hyper-V should review the relevant Microsoft advisories, determine exposure across guest and host infrastructure, and prioritize deployment of the corresponding security updates to reduce the chance of privilege escalation in enterprise virtualization deployments.
Jul 12, 2026
Microsoft disclosed **CVE-2026-40401**, an **Important** denial-of-service flaw in the Windows TCP/IP stack caused by a `NULL` pointer dereference and assigned it a **CVSS 7.1** score. The company said exploitation requires no privileges or user interaction, has not been publicly disclosed or observed in the wild, and is considered less likely to be exploited. Microsoft has released a security update to address the issue. The advisory warns that the bug can have broader impact in virtualized environments: a low-privilege **Hyper-V** guest could cross the guest boundary and trigger denial of service on the **Hyper-V host**. The disclosure aligns with Microsoft's continued patching of availability issues affecting virtualization components, including prior **Windows Hyper-V** denial-of-service flaws tracked as **CVE-2025-47999** and **CVE-2024-43633**, as well as a **Microsoft Virtual Hard Disk (VHDX)** denial-of-service issue, **CVE-2024-38264**.
Jun 29, 2026
Microsoft disclosed and patched three **Windows TCP/IP denial-of-service vulnerabilities** tracked as `CVE-2026-40405`, `CVE-2026-40413`, and `CVE-2026-40414`. The flaws stem from **NULL pointer dereference** conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues **Important**, assigned CVSS scores of **7.5** for `CVE-2026-40405` and **7.4** for `CVE-2026-40413` and `CVE-2026-40414`, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication. Microsoft said `CVE-2026-40413` and `CVE-2026-40414` are exploitable from an **adjacent network**, limiting attacks to the same network segment such as a shared switch or virtual network, while `CVE-2026-40405` is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a **scope change**, including scenarios in which a low-privilege **Hyper-V guest** could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Jun 29, 2026