How a Critical New Windows Flaw Lets Hackers Escape Virtual Machines to Hijack Your Main OS

On July 14, 2026, Microsoft’s monthly security update disclosed a critical vulnerability in Windows VMSwitch, the virtual networking engine that underlies the Windows Hyper-V hypervisor. Tracked as CVE-2026-57092, the security defect carries a Common Vulnerability Scoring System (CVSS) base score of 9.9, the maximum severity allocated to hypervisor-level flaws. The vulnerability is a Use-After-Free (UAF) memory corruption issue that permits a low-privileged user within a guest virtual machine to break out of the virtualised sandbox and execute arbitrary code on the underlying host operating system.

In modern enterprise architecture, virtualisation is the bedrock of multi-tenancy, security boundaries, and workload isolation. The release of this security advisory has triggered a scramble across corporate data centres, cloud providers, and development environments. If exploited, a single compromised virtual machine (VM) can compromise the host hardware entirely, jeopardising all neighboring workloads sharing the physical CPU and memory.

The Anatomy of CVE-2026-57092: Understanding the VMSwitch Use-After-Free

At the centre of this Windows virtual machine vulnerability is vmswitch.sys, the kernel driver responsible for running the Hyper-V Virtual Switch. The virtual switch acts as a Layer 2 software-defined network switch, routing traffic between virtual network adapters assigned to guest VMs, the parent management partition, and physical network cards. Because the virtual switch must process packet structures directly from untrusted guest partitions at extremely high speeds, it operates within the host’s privileged kernel space.

+-------------------------------------------------------------+
|                     Physical Host Kernel                    |
|                                                             |
|   +-----------------------------------------------------+   |
|   |         Hyper-V Virtual Switch (vmswitch.sys)       |   |
|   |  - Use-After-Free (UAF) Memory Corruption           |   |
|   |  - Processes incoming guest network packets         |   |
|   +-----------------------------------------------------+   |
|                              ^                              |
+------------------------------|------------------------------+
                               | VMBus / Hypercalls
+------------------------------|------------------------------+
|                     Guest Virtual Machine                   |
|                                                             |
|   +-----------------------------------------------------+   |
|   |         Guest Network Adapter (NetVSC Driver)       |   |
|   |  - Attacker executes local exploit payload         |   |
|   |  - Sends crafted, malformed packet requests        |   |
|   +-----------------------------------------------------+   |
|                                                             |
+-------------------------------------------------------------+

To achieve high-throughput network speeds, the guest operating system uses the Virtualization Service Client (NetVSC) driver to pass packet descriptions to the Virtualization Service Provider (vmswitch.sys) on the host using shared memory channels called VMBus ring buffers.

The Memory Safety Failure

A Use-After-Free vulnerability occurs when an application or driver continues to use a pointer that references a memory allocation after that allocation has been released (freed) by the system allocator. In the case of CVE-2026-57092, the flaw resides in how the virtual switch handles state synchronization during rapid network interface modifications, such as resetting the guest’s virtual network interface card (vNIC), modifying port features, or negotiating custom packet parameters.

The technical sequence of an exploitation attempt typically progresses as follows:

Memory Allocation: The guest VM sends a packet configuration request to the host. The host allocates a buffer in its non-paged kernel pool to store session-specific metadata or packet routing structures.
The Deallocation Request: The attacker, running code inside the guest, triggers a rapid series of events—such as simulating a hardware reset of the virtual adapter or closing a communication channel. This forces the host to free the previously allocated memory block.
The Synchronization Failure: Due to a logic error or lack of thread locking in vmswitch.sys, a worker thread on the host maintains an active reference (a dangling pointer) to the memory address that has just been released.
Heap Grooming: The attacker immediately floods the host memory allocator with carefully structured data from the guest. If timed precisely, the host allocator reassigns the recently freed memory block to hold the attacker’s data.
Dereferencing the Dangling Pointer: The host worker thread wakes up to process the original networking request, dereferencing the dangling pointer. Instead of reading genuine system configurations, it reads the attacker’s malicious structures, which are designed to override execution flow (e.g., pointing to system functions or Return-Oriented Programming (ROP) gadgets).
Host Hijack: The CPU executes the instructions under the host’s context, resulting in kernel-level remote code execution on the parent partition.

What makes this issue particularly dangerous is its CVSS attack vector of "Network" (AV:N) combined with "Low" privileges required (PR:L). While the exploit must be initiated by someone with execution rights within the guest VM, the vulnerability is reached through the virtualised networking stack. The attacker does not need to bypass Windows User Account Control (UAC) or achieve local administrative access inside the guest to target the host. They only require permission to send packets over the virtual network interface.

The Virtualisation Crisis: Hyper-V, KVM, and VMware under Siege

The disclosure of CVE-2026-57092 is not an isolated incident; it represents a compounding crisis in virtualisation security. For over two decades, the security industry has treated the virtual machine as an absolute boundary. While container breakout attacks have been viewed as relatively common due to shared OS kernels, hypervisors have been regarded as the gold standard of isolation.

However, recent disclosures show that hypervisor security is under immense strain. The vulnerability in Windows Hyper-V shares striking parallels with recent high-severity exploits across other platforms:

VMware ESXi (CVE-2025-22224, CVE-2025-22225): In early 2025, security researchers identified critical guest-to-host escapes in VMware ESXi, which were actively exploited by threat actors. In those real-world attacks, ransomware groups gained administrative access to a single virtualized corporate web server, executed VM escape code to bypass network segmentations, and hijacked the entire vCenter management console. Within hours, they deployed ransomware globally, leaving zero forensic trace inside the compromised VMs.
Linux KVM (CVE-2026-53359 "Januscape"): Only a week before the Microsoft patch, security researchers disclosed "Januscape," a critical vulnerability affecting the shadow Memory Management Unit (MMU) of the Linux Kernel-based Virtual Machine (KVM) hypervisor. Januscape similarly permitted untrusted guest operating systems running nested virtualisation to escape the hypervisor, threatening multi-tenant public clouds that rely heavily on KVM.

These overlapping crises point to a broader architectural issue. As hypervisors are updated with advanced hardware acceleration, virtual switches, nested virtualisation, and GPU-sharing mechanisms, their attack surface expands. What was once a minimal layer of code has evolved into a highly complex, multi-million-line software suite, significantly raising the probability of memory-corruption bugs.

Systematic Impact Analysis: Who is Exposed?

The scale of exposure for this Windows virtual machine vulnerability spans nearly the entire spectrum of modern Windows systems. Because Hyper-V is deeply integrated into Microsoft’s ecosystem, the vulnerability is not restricted to dedicated virtualisation servers.

+--------------------------------------------------------------------------------+
|                          CVE-2026-57092 Exposure Map                           |
+--------------------------------------------------------------------------------+
|  Vulnerable Role      | Operational Scenario                                    |
+-----------------------+--------------------------------------------------------+
|  Windows Server       | - Enterprise private clouds (Hyper-V Failover Clusters) |
|  (2016 - 2025)        | - Multi-tenant infrastructure & Web Hosting Providers  |
+-----------------------+--------------------------------------------------------+
|  Windows Client       | - Local development environments (Docker, WSL2)        |
|  (10, 11 Pro/Ent)     | - Windows Sandbox testing untrusted binaries           |
|                       | - Microsoft Defender Application Guard (WDAG)          |
+-----------------------+--------------------------------------------------------+
|  Public Cloud         | - Infrastructure-as-a-Service (IaaS) running Hyper-V   |
|  Infrastructure       | - Nested Virtualisation testing environments           |
+-----------------------+--------------------------------------------------------+

1. Enterprise Data Centres and Private Clouds

The primary targets of this flaw are enterprise private clouds utilizing Windows Server (including Windows Server 2016, 2019, 2022, 2022 23H2, and the newly released 2025 builds).

In a standard enterprise data centre, a cluster of hypervisors runs dozens of active VMs. These VMs are often segregated by security zones: some run external-facing web servers, others process internal HR data, and some might host test applications managed by developers. If an attacker gains a foothold on the public-facing web server through a routine application vulnerability (such as SQL injection or remote code execution), they can exploit CVE-2026-57092. Once they escape to the host, they gain SYSTEM-level access, allowing them to:

Read and write directly to the memory of every other VM running on that physical hardware.
Extract credentials from the host kernel memory (such as Active Directory domain admin credentials).
Deploy malware or ransomware across the underlying physical network.

2. Multi-Tenant and Managed Service Providers (MSPs)

Web hosting companies and managed service providers that rent out VPS (Virtual Private Server) instances running Hyper-V are heavily exposed. An attacker can rent a cheap, low-privileged Windows VM using a stolen credit card, execute the exploit locally, and instantly gain control of the host machine. From there, they can intercept network traffic, steal databases, and shut down operations for every customer hosting workloads on that physical server.

3. Developers and DevOps Engineers (WSL2 & Docker Desktop)

A highly overlooked vector is the local workstation of software developers and DevOps engineers. Windows Subsystem for Linux (WSL2) and Docker Desktop for Windows rely directly on lightweight Hyper-V utility VMs running in the background.

If a developer downloads a compromised open-source package (such as a malicious npm or PyPI dependency containing a backdoor) or runs an unvetted container image, the malware executes inside the WSL2 or container environment. Normally, developers assume this is safe because the execution is containerised or virtualised. However, with this Windows virtual machine vulnerability, the malware can escape the WSL2 utility VM, bypass physical boundaries, and compromise the developer’s primary Windows host. Once the developer's laptop is compromised, the attacker can harvest AWS API keys, Kubernetes secrets, or corporate SSH keys, triggering a massive supply-chain breach.

4. Security Sandboxes and Isolation Utilities

Security operations centres (SOCs) and malware analysts rely heavily on Windows Sandbox or Microsoft Defender Application Guard (WDAG) to safely run suspected malicious files or browse dangerous web domains. Both applications use a secure, containerised Hyper-V partition to isolate untrusted processes. Under CVE-2026-57092, an advanced malware specimen running inside the Windows Sandbox can break out of its cage, infect the analyst's host operating system, and establish lateral movement inside the security department's private network segment.

Immediate Operational Shifts: The Chaos of Emergency Patching

The discovery of a guest-to-host escape immediately changes the operational priorities of IT departments. However, patching a hypervisor-level vulnerability is vastly different from updating a standard client workstation.

The Live Migration Challenge

In modern high-availability environments, virtualisation hosts are organised in clusters. To patch a physical hypervisor without disrupting service, administrators use "Live Migration" (moving running virtual machines from one host to another with zero perceived downtime).

However, live-migrating resource-heavy virtual machines, such as active database clusters or ERP systems, places immense pressure on network infrastructure. If a data centre has 50 physical hosts running 1,000 active VMs, orchestrating live migrations to vacate, patch, reboot, and restore each host is a slow, methodical process that can take days. If a single VM crashes or fails to migrate during the transition, it can lead to costly operational downtime.

The Problem of Legacy and "Unpatchable" Systems

Many critical systems in manufacturing, healthcare, and finance run on older versions of Windows Server that are either outside their standard support lifecycle or require extensive regression testing before applying patches. Applying an emergency security update to a host running legacy industrial software carries the risk of breaking critical application dependencies.

Because of this, system administrators are often caught in a dangerous "patch gap"—the window of time between the public disclosure of a vulnerability and the actual deployment of the fix. During this period, threat actors analyze the patch, construct working proofs-of-concept (PoCs), and actively scan for exposed systems.

Short-Term Consequences: Exploit Development and the Threat Actor Pivot

Following Microsoft's disclosure on July 14, 2026, the global cybersecurity community entered a highly critical window. While there is currently no evidence of CVE-2026-57092 being actively exploited in the wild, history indicates this status will change rapidly.

Patch Reverse-Engineering and PoC Proliferation

Within days of a Patch Tuesday release, security researchers and threat actors use binary diffing tools (such as BinDiff or Ghidra) to compare the updated version of vmswitch.sys with the vulnerable version from the previous month. By isolating the exact code blocks modified by Microsoft developers—typically the introduction of stricter size checks, revised pointer validation, or thread-locking mechanisms—attackers can pinpoint the precise location of the use-after-free bug.

Original vmswitch.sys (Vulnerable)            Patched vmswitch.sys (Fixed)
+------------------------------------+        +------------------------------------+
|  // Processing packet              |        |  // Processing packet              |
|  void* buf = get_buffer();         |        |  void* buf = get_buffer();         |
|  free_buffer(buf);                 |  ===>  |  free_buffer(buf);                 |
|  // Dangling pointer persists      |        |  buf = NULL; // Pointer cleared    |
|  process_packet(buf);              |        |  if (buf != NULL) {                |
|                                    |        |      process_packet(buf);          |
|                                    |        |  }                                 |
+------------------------------------+        +------------------------------------+

Because of the high financial and strategic value of hypervisor escapes, both offensive security firms and nation-state threat actors are dedicating significant resources to crafting stable exploits. In the short term, we can expect:

Proof-of-Concept Releases: Private or semi-public security research groups will likely publish technical walk-throughs and unstable PoCs demonstrating memory corruption within the next 30 to 60 days.
Weaponisation by Ransomware Consortiums: Elite cybercriminal syndicates, particularly those specializing in double-extortion campaigns, will integrate these VM escape techniques into their playbooks. They will use them not for initial entry, but as a critical tool for lateral movement once they have gained a low-privileged foothold inside a target's internal network virtualisation layer.

Increased Host Instability

Because use-after-free exploits require precise memory timing, early-stage, script-kiddie-level exploitation attempts will be highly unstable. If the attacker’s heap-grooming routine is misaligned by even a few bytes, the host hypervisor will access protected memory addresses, leading to immediate system crashes.

In corporate environments, the first indicator of exploitation attempts will likely be a surge in "Blue Screen of Death" (BSOD) events across Hyper-V hosts, accompanied by SYSTEM_THREAD_EXCEPTION_NOT_HANDLED or PAGE_FAULT_IN_NONPAGED_AREA stop codes referencing vmswitch.sys.

Forensic Blindspots: Why Virtual Machine Escapes Are a Defender's Nightmare

When a standard host compromise occurs, security teams rely on a well-established forensic trail. Security agents, such as Endpoint Detection and Response (EDR) software, monitor system files, registry modifications, process creation, and network sockets. However, guest-to-host escapes bypass nearly all of these defensive monitors, creating severe visibility gaps for incident responders.

The Isolation Paradox

The primary issue is that security agents are installed inside the virtual machine or on the host operating system, but they rarely bridge the gap between them.

               +-------------------------------------------+
               |             EDR Blindspot Map             |
               +-------------------------------------------+

   [ GUEST VM ]                                              [ HOST PHYSICAL OS ]
+-------------------------+                              +-------------------------+
|  Active Security Agent  |                              |  Host Monitoring Tools  |
|                         |                              |                         |
|  - Monitors guest OS    |                              |  - Monitors Host OS     |
|  - Sees standard traffic|                              |  - Sees kernel processes|
|                         |                              |                         |
+-------------------------+                              +-------------------------+
             \                                                       /
              \                                                     /
               \                                                   /
                v                                                 v
         +---------------------------------------------------------------+
         |                  [ HYPERVISOR BOUNDARY ]                      |
         |                                                               |
         |   - Memory corruption occurs here (vmswitch.sys)              |
         |   - Exploit payload executes straight to memory               |
         |   - NO files written to disk                                  |
         |   - Guest EDR sees zero anomalies                             |
         |   - Host EDR sees no suspicious process creation              |
         +---------------------------------------------------------------+

If an attacker executes an exploit within a guest VM to target CVE-2026-57092, the guest-level EDR will register nothing out of the ordinary. The exploit code interacts directly with virtualised hardware registers or runs entirely in memory. The guest VM’s event logs will show standard operating parameters up until the connection to the host is severed.

On the host side, the monitoring tools are equally disadvantaged. Because the exploit runs at the kernel level within the vmswitch.sys driver, it does not rely on traditional malicious techniques such as launching an unauthorized powershell.exe or cmd.exe process. The attacker's code runs within the context of highly trusted system threads. To the host’s security agent, the CPU activity simply looks like an intense burst of network traffic processing.

Over-reliance on Traditional Logs

Traditional event logs are poorly equipped to detect memory corruption. While Microsoft provides logging for the virtual switch under the path Microsoft-Windows-Hyper-V-VMSwitch-Operational, these logs primarily record structural changes, such as adapter activations, port creations, and MAC address changes. They do not log raw heap allocations, memory pointers, or execution anomalies.

To detect an active exploit, threat hunters must analyze raw kernel memory dumps (MEMORY.DMP) or deploy advanced system calls monitoring tools that can flag abnormal control-flow changes, which is a highly specialized task beyond the capabilities of most security teams.

Long-Term Consequences: Structural Shifts and the Move toward Memory-Safe Kernels

The emergence of this critical Windows virtual machine vulnerability forces a deeper industry-wide reflection. It serves as a stark reminder that the decades-old practice of writing low-level virtualization infrastructure in memory-unsafe languages, such as C and C++, is becoming a major operational liability.

1. The Critical Transition to Rust

Over the next several years, this vulnerability will accelerate Microsoft's internal projects to rewrite core Windows subsystems in Rust, a modern systems-programming language that enforces memory safety at compile time.

Rust’s compiler strictly validates memory lifetimes, references, and pointer configurations. If Microsoft’s engineers write virtual switch and hypervisor networking components in Rust, use-after-free, buffer overflow, and double-free vulnerabilities are eliminated by default. While Microsoft has already begun implementing Rust in portions of the Windows kernel (such as the GDI graphics engine and specific storage systems), CVE-2026-57092 demonstrates that the virtualisation stack—specifically vmswitch.sys and the VMBus architecture—must be prioritized for immediate memory-safety rewrites.

2. The Decline of Virtualisation-Based Security (VBS) Credibility

For several years, Microsoft has promoted Virtualisation-Based Security (VBS) as a core defensive mechanism in Windows 10 and Windows 11. VBS uses the Hyper-V hypervisor to create an isolated, secure memory region (the Secure Kernel) that is segregated from the standard host operating system. This secure container is used to store sensitive security mechanisms, such as Credential Guard (which prevents the theft of LSASS credentials) and Hypervisor-Protected Code Integrity (HVCI).

The structural challenge of a guest-to-host escape is that it undermines the core assumption of VBS. If the underlying hypervisor component (vmswitch.sys) contains memory safety flaws that allow code execution at the highest host level, then the isolation of the Secure Kernel is compromised. If an attacker can hijack the host kernel, they can bypass VBS protections, access the Secure Kernel, and dump LSASS credentials anyway. This forces security architects to recognize that hypervisor security is only as strong as its most vulnerable virtual driver.

3. Rethinking Zero-Trust Architecture

In zero-trust networking models, security teams often segment systems under the assumption that if a VM is compromised, the threat is contained. They rely on "microsegmentation" to isolate virtualised workloads on the same physical host.

CVE-2026-57092 invalidates this containment model. In a post-CVE-2026-57092 world, security architectures must be redesigned to assume that host compromise is a realistic possibility whenever a guest VM is exposed to untrusted environments. As a result, organizations must adopt stricter hardware isolation patterns:

Dedicated Hardware Pools: Sensitive databases and critical financial systems should never share physical hypervisor hardware with public-facing web applications or development environments.
Strict Host-Level Microsegmentation: Security teams must implement firewalls and security rules that assume the host operating system has been breached, monitoring and restricting traffic moving from one hypervisor management interface to another.

Remediation, Hardening, and Strategic Response Roadmap

To defend against the immediate threat posed by CVE-2026-57092, organizations must move away from standard, passive patch-management routines. A high-severity hypervisor-level vulnerability demands an active, multi-layered hardening response.

+--------------------------------------------------------------------------------+
|                          Remediation Checklist                                 |
+--------------------------------------------------------------------------------+
|  Step                                | Key Actions                             |
+--------------------------------------+-----------------------------------------+
|  1. Audit and Map                    | - Identify all physical Hyper-V hosts   |
|                                      | - Record current OS build levels        |
+--------------------------------------+-----------------------------------------+
|  2. Apply Security Patches           | - Deploy July 14, 2026 Windows Updates  |
|                                      | - Target hypervisor hosts first         |
+--------------------------------------+-----------------------------------------+
|  3. Harden Host Configurations       | - Disable unused vNIC extensions        |
|                                      | - Enforce least-privileged VM controls  |
+--------------------------------------+-----------------------------------------+
|  4. Implement Isolation Networks     | - Segregate management networks        |
|                                      | - Block guest VM access to host IPs     |
+--------------------------------------+-----------------------------------------+
|  5. Deploy Detection Telemetry       | - Configure kernel crash monitoring     |
|                                      | - Set up alerts for host instability    |
+--------------------------------------+-----------------------------------------+

Phase 1: Rapid Inventory and Assessment

Before deploying updates, security administrators must locate all systems running the Hyper-V role. This include:

Standard virtualization clusters (Windows Server Failover Clustering).
Standalone branch-office servers running Windows Server.
Developer workstations using Windows client versions with Hyper-V enabled for Docker, WSL2, or Windows Sandbox.

Administrators should execute a PowerShell script across their Active Directory environment to query the status of the Hyper-V service:

# Check if the Hyper-V role is active on the local machine
$HyperVStatus = Get-WindowsFeature -Name Hyper-V -ErrorAction SilentlyContinue
if ($HyperVStatus -and $HyperVStatus.Installed) {
    Write-Host "WARNING: Hyper-V is ACTIVE on this system. Mitigation required." -ForegroundColor Yellow
} else {
    Write-Host "INFO: Hyper-V is not active." -ForegroundColor Green
}

Phase 2: Patching Prioritization and Deployment

The July 14, 2026 update must be deployed systematically. Because hypervisors must be rebooted to apply updates to vmswitch.sys, organizations should prioritize patching according to risk exposure:

Tier 1: High-Exposure Hosts: Any hypervisor running public-facing application servers, external web proxies, or customer-accessible virtual desktops.
Tier 2: Multi-Tenant and Dev Environments: Hyper-V servers used by developers to run unvetted open-source code or container workloads.
Tier 3: Internal Production Servers: Back-office systems, Active Directory domain controllers, and private database engines.

To ensure the patch is successfully applied, verify that the host's OS build version is equal to or greater than the builds released on July 14, 2026. Simply running the update client is insufficient; the server must undergo a complete reboot to unload the vulnerable vmswitch.sys driver and load the patched version.

Phase 3: Technical Hardening and Best Practices

For legacy systems where patching is temporarily delayed, or as an added layer of defense, administrators should implement the following hardening guidelines:

Deactivate Unnecessary Network Services: Disable SR-IOV (Single Root I/O Virtualization) and VMQ (Virtual Machine Queues) on virtual switch adapters if they are not actively required, minimizing the code path complexity within vmswitch.sys.
Minimize Guest-to-Host Communication Paths: By default, Hyper-V permits guest VMs to communicate with the host's internal management partition over virtual networks. Apply strict Windows Firewall rules on the host to block all inbound traffic originating from guest IP addresses.
Restrict VM Administrative Delegation: Restrict access to virtual machine configuration management. Only authorized virtualization administrators should be allowed to modify vNIC settings, attach new adapters, or adjust network switches.
Run Containers in Isolated Virtual Environments: For development teams running Docker Desktop, ensure that WSL2 is fully updated, and consider moving highly sensitive coding tasks to dedicated, physically isolated development laptops.

Phase 4: Setting up Detection Telemetry

While direct detection of the use-after-free exploit in memory is difficult, security operations centres should configure their Security Information and Event Management (SIEM) systems to alert on indirect indicators:

Monitor Hyper-V Driver Crashes: Configure automated alerts for Event ID 1001 (Windows Error Reporting) or Event ID 41 (Kernel-Power) where the faulting module is identified as vmswitch.sys. A cluster of unexpected BSOD events in a short timeframe is a strong indicator of active, unstable exploitation attempts.
Identify Guest Network Flapping: Set up detection alerts for rapid guest network adapter state changes (connecting, disconnecting, resetting) within a short window, which may indicate an attacker attempting to groom the host heap.

Looking Forward: The Ongoing Battle for Virtualization Integrity

As organizations complete the patching cycle for CVE-2026-57092, the broader battle over virtualization integrity will continue to dominate the security landscape. The events of mid-2026 have demonstrated that hypervisors are no longer the impenetrable fortresses they were once assumed to be.

Looking ahead, we must expect a steady stream of research targeting VM networking, memory allocation, and hardware-sharing technologies. The long-term safety of enterprise cloud workloads will depend heavily on the velocity with which platform vendors like Microsoft transition their core, privilege-heavy components to memory-safe languages like Rust, and how effectively enterprise organizations embrace zero-trust models that assume host-level compromise is always just one exploit away. For now, the most critical task is clear: audit, patch, reboot, and verify.

Verifiable References

[1] CVE-2026-57092 (Critical): Windows VMSwitch Use-After-Free Elevation of Privilege / Remote Code Execution Vulnerability (CVSS 9.9) published July 14, 2026.
[2] CVE-2026-53359 (Januscape): Critical Linux Kernel KVM shadow MMU VM escape vulnerability disclosed July 7, 2026.
[3] CVE-2025-22224 / CVE-2025-22225: Critical VMware ESXi guest-to-host escape vulnerabilities actively exploited by ransomware actors in 2025.
[4] Microsoft Security Update Guide: Release details for July 14, 2026, covering Hyper-V, SharePoint, and Exchange Server patches.
[5] National Vulnerability Database (NVD): CVE-2026-57092 vulnerability metrics and CWE-416 (Use-After-Free) classification.