CVE-2020-1040: Microsoft Hyper-V RemoteFX vGPU input validation remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 3.1 score is 9.0 with scope change and high confidentiality, integrity and availability impact, and the flaw is in CISA KEV with a required patch action.

What it is

Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system, allowing remote code execution. The flaw is critical because a guest user can escape the guest boundary and execute code on the host, and it is listed in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker with authenticated access to a guest VM can execute arbitrary code on the Hyper-V host, compromising the host and potentially other guests on the same system.

Attack surface

The vulnerability is reached over an adjacent network (AV:A) from a guest operating system; it requires low privileges (PR:L) and no user interaction (UI:N), meaning an authenticated guest user can trigger it without tricking a host user.

Exploitation

CVE-2020-1040 is listed in CISA KEV with a required action to apply vendor updates, and EPSS shows a 30-day probability of about 7.3 percent (94th percentile), indicating meaningful exploitation activity. No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2020-1040 as soon as possible.
• If RemoteFX vGPU is not required, disable it on Hyper-V hosts to remove the attack surface.
• Restrict guest VM administrative access and limit which users can create or operate VMs on affected hosts.
• Follow CISA KEV required action guidance and verify remediation across Windows Server 2008, 2012 and 2016 hosts.
• Monitor NVIDIA and Microsoft advisories for any additional driver-level guidance tied to RemoteFX vGPU.

Detection

• Monitor Hyper-V host and guest logs for unexpected process creation or crashes originating from RemoteFX vGPU activity.
• Alert on unusual guest-to-host network or device interactions involving RemoteFX vGPU on affected Windows Server versions.
• Track hosts still running RemoteFX vGPU and cross-check patch status against the MSRC advisory.
• Correlate guest VM user activity with host-side code execution or privilege escalation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.