Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Low-privileged network attacker triggers resource exhaustion in LSASS; impact is availability-only, no confidentiality or integrity effect, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
AnalysisAI
LSASS denial-of-service in Microsoft Windows enables authenticated network attackers to exhaust resources in the Local Security Authority Subsystem Service, crashing it and forcing a system reboot across a wide range of Windows 10, 11, and Server releases spanning Windows Server 2012 through Server 2025. Microsoft has released patched builds via its standard update cycle; no public exploit code exists and CISA has not listed this in KEV. Despite the broad product footprint, EPSS of 0.79% and SSVC exploitation status of 'none' indicate low current threat activity, though domain controllers represent elevated-risk targets due to LSASS's role as the authentication hub.
Technical ContextAI
LSASS (Local Security Authority Subsystem Service) is a critical Windows kernel-adjacent process responsible for enforcing security policy, handling NTLM and Kerberos authentication handshakes, and issuing access tokens. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause as a failure to bound memory or CPU allocation when processing certain network-delivered inputs, allowing a low-privileged caller to trigger runaway consumption. Because LSASS runs as SYSTEM and is non-restartable without a full reboot, resource exhaustion translates directly to system unavailability. Affected CPE strings span cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012_r2, confirmed by EUVD-2026-43816 version ranges covering both legacy (Windows Server 2012, build 6.2.x) and current (Windows Server 2025, build 10.0.26100.x) releases.
RemediationAI
Apply Microsoft's released patches per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49799. Fixed builds confirmed by EUVD-2026-43816 are: Windows 10 22H2 → 10.0.19045.7548, Windows 10 21H2 → 10.0.19044.7548, Windows 10 1809 / Server 2019 → 10.0.17763.9020, Windows 10 1607 / Server 2016 → 10.0.14393.9339, Windows 11 24H2 / Server 2025 → 10.0.26100.8875 (client) / 10.0.26100.33158 (server), Windows 11 25H2 → 10.0.26200.8875, Windows 11 26H1 → 10.0.28000.2269, Server 2022 → 10.0.20348.5386, Server 2012 R2 → 6.3.9600.23291, Server 2012 → 6.2.9200.26226. No documented official workaround exists. If patching is temporarily infeasible on domain controllers or authentication servers, restrict inbound network access to LSASS-related ports (TCP 135, 445, and ephemeral RPC range 49152-65535) via host-based Windows Firewall or upstream network ACL to trusted hosts only - note this will break domain authentication for unrestricted clients and must be tested thoroughly before production deployment.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-43816
GHSA-h76x-qhx5-46mg