How severe is CVE-2026-83728?

CVE-2026-83728 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-83728 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-83728?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-83728 published?

CVE-2026-83728 was published on 2026-10-13 and last updated on 2026-10-16.

CVE-2026-83728

CVE-2026-83728 is a high-severity vulnerability with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1286.

Key facts

Severity: High (CVSS 3.x base score 8.8)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1286
Published: 2026-10-13
Last modified: 2026-10-16

Description

Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.

Frequently asked questions

What is CVE-2026-83728?: Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform spoofing locally.
How severe is CVE-2026-83728?: CVE-2026-83728 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-83728 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-83728?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-83728 published?: CVE-2026-83728 was published on 2026-10-13 and last updated on 2026-10-16.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83728

Other CWE-1286 vulnerabilities

CVE-2026-110759 — Critical (CVSS 9.8): Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed…
CVE-2026-87080 — Critical (CVSS 9.1): Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it…
CVE-2025-41719 — High (CVSS 8.8): A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of…
CVE-2026-6442 — High (CVSS 8.3): Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands…
CVE-2026-102084 — High (CVSS 8.1): An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS…
CVE-2024-26507 — High (CVSS 7.8): An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a…

Browse all CWE-1286 vulnerabilities →