CVE-2026-20825: 
vulnerability analysis and mitigation

CVE-2026-20825 is an improper access control vulnerability in Windows Hyper-V that allows an authorized attacker with high privileges to disclose sensitive information locally. It was published on January 13, 2026, as part of Microsoft's January 2026 Patch Tuesday release. Affected products include Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2), Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium), assigned by Microsoft (Microsoft MSRC, Feedly).

The vulnerability is classified as CWE-284 (Improper Access Control) within the Windows Hyper-V hypervisor component. An attacker who already holds high-level privileges on a local system can exploit insufficient access control enforcement in Hyper-V to read sensitive information that should be restricted. The attack vector is local, requires no user interaction, and has low attack complexity, but the high privilege prerequisite significantly limits the attack surface. No public technical write-ups or proof-of-concept code have been identified (Microsoft MSRC, Feedly).

Successful exploitation results in unauthorized disclosure of sensitive information accessible through the Hyper-V subsystem, with no impact on integrity or availability. Because the attacker must already possess high administrative privileges and local access, the practical exposure is limited to insider threats or post-compromise scenarios where an attacker has already achieved elevated access. There is no evidence of lateral movement capability or remote code execution risk associated with this vulnerability (Feedly).

Microsoft released security updates on January 13, 2026, addressing this vulnerability across all affected platforms. Administrators should apply the following patched builds: Windows 10 1809/Server 2019 → 10.0.17763.8276; Windows 10 21H2 → 10.0.19044.6809; Windows 10 22H2 → 10.0.19045.6809; Windows 11 23H2 → 10.0.22631.6491; Windows 11 24H2 → 10.0.26100.7623; Windows 11 25H2 → 10.0.26200.7623; Windows Server 2022 → 10.0.20348.4648; Windows Server 2022 23H2 → 10.0.25398.2092; Windows Server 2025 → 10.0.26100.32230. As a compensating control, organizations should restrict high-privilege local access to Hyper-V hosts to only authorized personnel (Microsoft MSRC).

The vulnerability was covered as part of broader January 2026 Patch Tuesday roundups by security outlets including BleepingComputer, Sophos, Zero Day Initiative, and CyberSecurityNews, though it received limited individual attention given its medium severity and high privilege requirement. The Zero Day Initiative's January 2026 Patch Tuesday review and Sophos's analysis both noted the patch batch as a whole without singling out this CVE. Community sentiment reflects low urgency due to the constrained attack conditions (ZDI Blog, Sophos Blog).