Windows LSASS CVE-2026-49799

The CVSS vector (PR:L) confirms that a valid authenticated account is required - unauthenticated exploitation is not possible. The attacker must reach the target system over the network (AV:N), requiring at minimum network-level connectivity to the host, though no VPN or special routing beyond basic reachability is implied. Attack complexity is low (AC:L), meaning no race conditions, specific timing, or environmental dependencies are documented. No specific non-default Windows feature or configuration is identified in available data as a prerequisite. Exploitation is limited by: the authentication barrier (any valid domain or local account), the SSVC 'Automatable: no' classification (cannot be easily mass-scanned or worm-propagated), and the purely availability-only impact (no credential theft or code execution). Domain controllers carry the highest residual risk because LSASS failure there disrupts authentication for the entire domain rather than a single host.

CVSS 6.5 (Medium) is consistent with the attack profile: AV:N (network reachable), AC:L (no complexity barriers), PR:L (requires a valid account), and A:H (full availability loss) with no confidentiality or integrity impact. EPSS at 0.79% (52nd percentile) places exploitation probability well below actively targeted vulnerabilities. SSVC rates exploitation as 'none' and impact as 'partial', reinforcing the current low threat level, and the 'Automatable: no' flag suggests the attack requires non-trivial interaction rather than mass scanning. No CISA KEV listing and no known POC further reduce urgency for general workstations. However, the risk picture changes materially for domain controllers: LSASS DoS on a DC disrupts Kerberos ticket issuance and NTLM challenges enterprise-wide, making any reboot a significant operational event. The PR:L requirement does narrow the threat to insider threats, post-compromise lateral movement actors, or compromised low-privilege accounts - it is not an unauthenticated internet-facing risk. Priority should be elevated for authentication infrastructure and domain controllers relative to standard endpoints.

A low-privileged domain user or local account holder with network access to a target Windows host crafts a sequence of specially formed requests directed at the LSASS service. The service allocates resources without enforcing an upper bound, eventually exhausting available memory or CPU until the process crashes and forces a system reboot, denying service to all users on that host. No public proof-of-concept is known, and SSVC's 'Automatable: no' rating indicates manual effort or specific trigger conditions are likely required rather than simple mass exploitation.