Windows Server 2016 CVE-2026-26155

This vulnerability presents a moderate real-world risk with contextual factors. The CVSS score of 6.5 reflects a network-accessible, low-complexity attack requiring authenticated access, with high confidentiality impact (C:H) but no integrity or availability impact (I:N/A:N). The EPSS exploitation probability and active exploitation status are not provided, but no public exploit code or CISA KEV confirmation is documented. The authentication requirement (PR:L) significantly reduces real-world attack surface compared to unauthenticated vulnerabilities; an attacker must already have valid credentials or compromise a user account first. However, once authenticated, exploitation is trivial (AC:L) and requires no user interaction (UI:N). The attack scope is unchanged (S:U), limiting lateral movement potential but keeping impact localized to the authenticated user's privilege context. In SSVC terms, this is an automatable attack by a previously-authorized actor; organizations should prioritize patching based on credential exposure risk and user privilege levels. For high-value targets (e.g., domain-joined servers, systems handling sensitive data), this warrants priority patching despite the authentication requirement.

An authenticated attacker with valid user credentials connects to a vulnerable Windows system over the network and sends a specially crafted request to the Local Security Authority Subsystem Service. By exploiting the bounds check bypass in LSASS, the attacker reads sensitive memory contents including authentication tokens, password hashes, or cached credentials. These credentials can be used to escalate privileges or move laterally within the network, though the attack requires prior authentication and does not directly grant code execution or system compromise.