Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Low-privileged network attacker triggers resource exhaustion in LSASS; impact is availability-only, no confidentiality or integrity effect, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 17:37 vuln.today
CVE Published
Jul 14, 2026 - 17:06 cve.org
MEDIUM 6.5

DescriptionCVE.org

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

AnalysisAI

LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.

Technical ContextAI

LSASS (Local Security Authority Subsystem Service) is a critical Windows kernel-adjacent process responsible for enforcing security policy, handling NTLM and Kerberos authentication handshakes, and issuing access tokens. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as a failure to bound memory or CPU allocation when processing certain network-delivered inputs, allowing a low-privileged caller to trigger runaway consumption. Because LSASS runs as SYSTEM and is non-restartable without a full reboot, resource exhaustion translates directly to system unavailability. Affected CPE strings span cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012_r2, confirmed by EUVD-2026-43816 version ranges covering both legacy (Windows Server 2012, build 6.2.x) and current (Windows Server 2025, build 10.0.26100.x) releases.

RemediationAI

Apply Microsoft's released patches per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49799. Fixed builds confirmed by EUVD-2026-43816 are: Windows 10 22H2 → 10.0.19045.7548, Windows 10 21H2 → 10.0.19044.7548, Windows 10 1809 / Server 2019 → 10.0.17763.9020, Windows 10 1607 / Server 2016 → 10.0.14393.9339, Windows 11 24H2 / Server 2025 → 10.0.26100.8875 (client) / 10.0.26100.33158 (server), Windows 11 25H2 → 10.0.26200.8875, Windows 11 26H1 → 10.0.28000.2269, Server 2022 → 10.0.20348.5386, Server 2012 R2 → 6.3.9600.23291, Server 2012 → 6.2.9200.26226. No documented official workaround exists. If patching is temporarily infeasible on domain controllers or authentication servers, restrict inbound network access to LSASS-related ports (TCP 135, 445, and ephemeral RPC range 49152-65535) via host-based Windows Firewall or upstream network ACL to trusted hosts only - note this will break domain authentication for unrestricted clients and must be tested thoroughly before production deployment.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-49799 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy