What you need to know
- Security experts found a critical vulnerability in Hyper-V's virtual network switch driver.
- Microsoft gave the vulnerability a 9.9/10 critical severity score.
- A patch was released for the vulnerability back in May, but many organizations likely have not installed it yet.
A critical vulnerability in Hyper-V's virtual network was discovered by Guardicore Labs and SafeBreach Labs. If exploited, an attacker can "take down whole regions of the cloud," according to Guardicore.
The vulnerability affects Windows 10 as well as Windows Server 2021 through 2019. SafeBreach's Peleg Hadar and Gardicore's Opher Harpaz discovered the fault and will discuss it at the Black Hat security conference in August 2021. The researchers have already privately disclosed the vulnerability to Microsoft.
As explained by BleepingComputer, the vulnerability can be used to terminate all virtual machines running on a Hyper-V host. An attacker could also gain control of a host and all virtual machines attached to it. To exploit the vulnerability, an attacker needs to have access to a guest virtual machine.
First appearing in August 2019, the vulnerability was given a 9.9/10 critical severity score by Microsoft. The vulnerability was labeled CVE-2021-28476 (opens in new tab) by Microsoft.
The issue is quite technical, but Harpaz and Hadar explain its risks in layman's terms:
Microsoft released a patch for this vulnerability in May 2021, but Harpaz told BleepingComputer that some vulnerabilities remain unpatched for years.
"There are so many Windows Servers today that are vulnerable to well-known bugs, I won't be surprised if this bug stays unpatched for a very long time in organizations," said Harpaz.
Sean Endicott is the news writer for Windows Central. If it runs Windows, is made by Microsoft, or has anything to do with either, he's on it. Sean's been with Windows Central since 2017 and is also our resident app expert. If you have a news tip or an app to review, hit him up at email@example.com.
Get the best of Windows Central in in your inbox, every day!
Thank you for signing up to Windows Central. You will receive a verification email shortly.
There was a problem. Please refresh the page and try again.