KB5009557: Windows Server 2019 Security Update (January 2022)
An attacker on one Hyper-V guest VM can interact with processes inside another guest on the same host — a partial guest-to-guest isolation breach.
An attacker with any code execution inside one Hyper-V guest can interact with processes inside other guests on the same physical Hyper-V host, bypassing the isolation that is supposed to keep tenants separate. The exact scope of the cross-guest interaction depends on what Hyper-V capabilities are reachable, but the security guarantee being violated is fundamental.
Hyper-V is the Windows hypervisor that isolates guest VMs from each other and from the host. A flaw in Hyper-V's privilege boundary lets an attacker who already has code execution inside one guest VM interact with processes hosted in another guest on the same physical host. This is not a full guest-to-host escape — it is a guest-to-guest isolation breach.
Probably yes if any of these apply:
Affected OS versions
A multi-tenant Hyper-V host runs different customers' workloads side by side. One customer is compromised through their own application stack; the attacker uses the Hyper-V EoP to reach into another customer's VM on the same physical host, read process memory, and steal credentials. The shared-host trust model is broken.
Manual download
For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.
↗ Microsoft Update CatalogKB5009557Manual remediation steps
Prerequisites
Estimated time
20–40 minutes per server (download + install + reboot)
Reboot required
Yes — install the cumulative update and reboot the server before the fix is active.
Steps
1. Confirm the server is missing the patch
Get-HotFix -Id KB5009557 -ErrorAction SilentlyContinue
2. Install the update — pick one channel
Windows Update / WSUS (preferred):
UsoClient ScanInstallWait
Manual download (offline / air-gapped):
3. Reboot
Restart-Computer -Force
Verification
Get-HotFix -Id KB5009557
[System.Environment]::OSVersion.Version
Rollback
wusa.exe /uninstall /kb:5009557 /quiet /norestart
Notes
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.