Windows lsasrv CVE-2026-69365

Exploitation requires a low-privileged authenticated account (PR:L, consistent with Microsoft's 'authorized attacker' phrasing) with network access to the target Windows system's LSA RPC interface. Additionally, user interaction (UI:R) is required - likely meaning a victim user must initiate an LSA-related operation (such as authentication, policy lookup, or credential validation) that the attacker can influence or intercept. Exploitation is limited to unpatched Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2022, and Windows Server 2025 systems below the fixed build thresholds. No special non-default configuration is implied; the vulnerability exists in the default lsasrv component present on all affected OS builds.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a meaningful but bounded risk profile. PR:L confirms the requirement for a low-privileged authenticated account, and UI:R introduces a dependency on victim interaction - both factors reduce exploitability compared to a fully unauthenticated, no-interaction scenario. Despite these constraints, the C:H/I:H/A:H impact triad in a core authentication component is severe: full compromise of the vulnerable system is plausible upon successful exploitation. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. The absence of a known public exploit further reduces immediate automated attack risk. However, lsasrv's ubiquitous deployment across Windows environments makes this a high-value target for post-compromise lateral movement or privilege escalation chains, and the network attack vector means it is reachable without physical access. The UI:R metric in an LSA context likely reflects attacker dependence on a victim-initiated authentication or policy operation - this somewhat limits opportunistic exploitation but is achievable in targeted scenarios.

An attacker with a low-privileged domain or local account crafts a malformed RPC message targeting the lsasrv network interface, timing the request to coincide with an LSA operation initiated by a victim user (satisfying UI:R). The out-of-bounds read discloses memory contents or corrupts internal state within the LSA process, enabling the attacker to escalate their privileges - potentially to SYSTEM or local administrator. No public exploit code has been identified at time of analysis.