CVE-2021-38672
published 2021-10-13CVE-2021-38672: Windows Hyper-V Remote Code Execution Vulnerability
PriorityP350critical9CVSS 3.1
AVAACLPRLUINSCCHIHAH
EPSS
1.06%
60.9th percentile
Windows Hyper-V Remote Code Execution Vulnerability
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.258 | 10.0.22000.258 |
| microsoft | windows_server_2022 | >= 10.0.0 < 10.0.20348.288 | 10.0.20348.288 |
| msrc | windows_11_version_21h2_for_x64-based_systems | — | — |
| msrc | windows_server_2022 | — | — |
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.05.2MEDIUMAV:A/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows Hyper-V Remote Code Execution Vulnerability
vendor_msrc·2021-10-12·CVSS 8.0
CVE-2021-38672 [HIGH] Windows Hyper-V Remote Code Execution Vulnerability
Windows Hyper-V Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
For successful exploitation, this vulnerability could allow a malicious guest VM to read kernel memory in the host. To trigger this vulnerability the guest VM requires a memory allocation error to first occur on the guest VM. This bug could be used for a VM escape from guest to host.
Role: Windows Hyper-V: Role: Windows Hyper-V
Microsoft: Microsoft
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5006699
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q
GHSA
GHSA-v4jp-hh77-wpg7: Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-38672
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2021-40461 [HIGH] GHSA-v4jp-hh77-wpg7: Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-38672
Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-38672.
GHSA
GHSA-c3x4-42jc-832x: Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40461
ghsa_unreviewed·2022-05-24·CVSS 8.0
CVE-2021-38672 [HIGH] GHSA-c3x4-42jc-832x: Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40461
Windows Hyper-V Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40461.
No detection rules found.
No public exploits indexed.
Talos
Threat Source newsletter (Oct. 14, 2021)
blogs_talos·2021-10-14
Threat Source newsletter (Oct. 14, 2021)
## Threat Source newsletter (Oct. 14, 2021)
Good afternoon, Talos readers.
It's still Cybersecurity Awareness Month, and what better way to celebrate by patching and then patching some more?
This week was Microsoft Patch Tuesday , which only included two critical vulnerabilities, but still requires patching diligence. Here's our full breakdown of this month's security updates for Microsoft products, and some additional details on a code execution vulnerability we discovered in Excel .
If you're looking for other ways to celebrate this month of security awareness, you can also listen to our latest special edition of Talos Takes reflecting on ransomware in 2021. The Cisco newsroom also wrote up a profile on one of our researchers, Vanja Svajcer , if you want to find out what a day in the
Talos
Threat Source newsletter (Oct. 14, 2021)
blogs_talos·2021-10-14
Threat Source newsletter (Oct. 14, 2021)
Good afternoon, Talos readers.
It's still Cybersecurity Awareness Month, and what better way to celebrate by patching and then patching some more?
This week was Microsoft Patch Tuesday, which only included two critical vulnerabilities, but still requires patching diligence. Here's our full breakdown of this month's security updates for Microsoft products, and some additional details on a code execution vulnerability we discovered in Excel.
If you're looking for other ways to celebrate this month of security awareness, you can also listen to our latest special edition of Talos Takes reflecting on ransomware in 2021. The Cisco newsroom also wrote up a profile on one of our researchers, Vanja Svajcer, if you want to find out what a day in the life of a threat researcher is like.
Do you ha
Qualys
Microsoft & Adobe Patch Tuesday (October 2021) – Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities
blogs_qualys·2021-10-13·CVSS 9.0
CVE-2021-40449 [CRITICAL] Microsoft & Adobe Patch Tuesday (October 2021) – Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities
## Microsoft Patch Tuesday – October 2021
Microsoft patched 74 vulnerabilities in their October 2021 Patch Tuesday release, of which three are rated as critical severity and four were previously reported as zero-days.
## Critical Microsoft Vulnerabilities Patched
CVE-2021-40449 – Win32k Elevation of Privilege Vulnerability
This was a zero-day, and one of the four addressed by Microsoft this month. This vulnerability impacts the Win32K kernel driver. This is being actively exploited by IronHusky and Chinese APT groups. Microsoft has assigned a CVSSv3 base score of 7.8 to this vulnerability and it should be prioritized for patching.
CVE-2021- 40486 – Microsoft Word Remote Code Execution Vulnerability
This vulnerability is due to improper input validation in Microsoft Word. Adversaries
Krebs
Patch Tuesday, October 2021 Edition
blogs_krebs·2021-10-13·CVSS 7.8
[HIGH] Patch Tuesday, October 2021 Edition
Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited. This month’s Patch Tuesday also includes security fixes for the newly released Windows 11 operating system. Separately, Apple has released updates for iOS and iPadOS to address a flaw that is being actively attacked.
Firstly, Apple has released iOS 15.0.2 and iPadOS 15.0.2 to fix a zero-day vulnerability (CVE-2021-30883) that is being leveraged in active attacks targeting iPhone and iPad users. Lawrence Abrams of Bleeping Computer writes that the flaw could be used to steal data or install malware, and that soon after Apple patched the bug security researcher Saar Amar published a technical writeup and proof-of
Qualys
Microsoft & Adobe Patch Tuesday (October 2021) – Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities | Qualys
blogs_qualys·2021-10-13·CVSS 9.0
CVE-2021-40449 [CRITICAL] Microsoft & Adobe Patch Tuesday (October 2021) – Microsoft 74 Vulnerabilities with 3 Critical, 4 Zero-Days. Adobe 10 Vulnerabilities | Qualys
### Microsoft Patch Tuesday – October 2021
Microsoft patched 74 vulnerabilities in their October 2021 Patch Tuesday release, of which three are rated as critical severity and four were previously reported as zero-days.
### Critical Microsoft Vulnerabilities Patched
CVE-2021-40449 – Win32k Elevation of Privilege Vulnerability
This was a zero-day, and one of the four addressed by Microsoft this month. This vulnerability impacts the Win32K kernel driver. This is being actively exploited by IronHusky and Chinese APT groups. Microsoft has assigned a CVSSv3 base score of 7.8 to this vulnerability and it should be prioritized for patching.
CVE-2021- 40486 – Microsoft Word Remote Code Execution Vulnerability
This vulnerability is due to improper input validation in Microsoft Word. Adversarie
Trendmicro
October Patch Tuesday: 3 Critical Bulletins Among 71
blogs_trendmicro·2021-10-13·CVSS 8.0
[HIGH] October Patch Tuesday: 3 Critical Bulletins Among 71
Exploits & Vulnerabilities
# October Patch Tuesday: 3 Critical Bulletins Among 71
The October Patch Tuesday maintains the relatively peaceful streak from previous months with only 3 bulletins rated as Critical among 71 new vulnerabilities.
By: Trend Micro
2021/10/13
Read time: ( words)
Save to Folio
The October 2021 Patch Tuesday continues the quiet streak observed for the months of August and September. Out of 71 bulletins, only three were rated Critical this month. The list also included a fix for four publicly known vulnerabilities. Of the fixed vulnerabilities, 11 were disclosed via the Zero Day Initiative.
Three Critical patches and other notable vulnerabilities
Only three patches were rated Critical this month. Two of them were remote code execution (RCE) vulnerabilities (CVE
Talos
Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-10-12·CVSS 8.8
[HIGH] Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Asheer Malhotra.
Microsoft released its monthly security update Tuesday, disclosing 78 vulnerabilities in the company’s various software, hardware and firmware offerings.
This month’s release is particularly notable because there are only two critical vulnerabilities included, with the rest being important. This is the fewest number of critical vulnerabilities disclosed as part of a Patch Tuesday in at least a year.
CVE-2021-40461 is one of the critical vulnerabilities — a flaw in the Network Virtualization Service Provider that could allow an attacker to execute remote code on the target machine. This vulnerability has a severity rating of 9.9 out of a possible
Krebs
Patch Tuesday, October 2021 Edition
blogs_krebs·2021-10-12·CVSS 7.8
[HIGH] Patch Tuesday, October 2021 Edition
Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited. This month’s Patch Tuesday also includes security fixes for the newly released Windows 11 operating system. Separately, Apple has released updates for iOS and iPadOS to address a flaw that is being actively attacked.
Firstly, Apple has released iOS 15.0.2 and iPadOS 15.0.2 to fix a zero-day vulnerability (CVE-2021-30883) that is being leveraged in active attacks targeting iPhone and iPad users. Lawrence Abrams of Bleeping Computer writes that the flaw could be used to steal data or install malware, and that soon after Apple patched the bug security researcher Saar Amar published a technical writeup and proof-of
Talos
Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities
blogs_talos·2021-10-12·CVSS 8.8
CVE-2021-40461 [HIGH] Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities
By Jon Munshaw, with contributions from Asheer Malhotra.
Microsoft released its monthly security update Tuesday, disclosing 78 vulnerabilities in the company’s various software, hardware and firmware offerings.
This month’s release is particularly notable because there are only two critical vulnerabilities included, with the rest being important. This is the fewest number of critical vulnerabilities disclosed as part of a Patch Tuesday in at least a year.
CVE-2021-40461 is one of the critical vulnerabilities — a flaw in the Network Virtualization Service Provider that could allow an attacker to execute remote code on the target machine. This vulnerability has a severity rating of 9.9 out of a possible 10, virtually the highest severity rating seen in Patch Tuesdays.
The other critical
Crowdstrike
October 2021 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] October 2021 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
2021-10-13
Published