EUVD-2026-99641
GHSA-pmfc-fqp7-9r9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
ExploitTrigger race condition in lsasrv
-
ExecutionWin timing window to bypass access control
-
ImpactElevate to SYSTEM-level privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess valid low-privilege local execution on the target Windows host (PR:L, AV:L) - there is no remote or network path. Exploitation further depends on winning a race condition (CWE-362, reflected as AC:H) in the Local Security Authority Server process, meaning the attacker must repeatedly trigger the flaw to hit the narrow timing window; no user interaction is needed (UI:N). Limiting factors for defenders: the prerequisite of existing authenticated local access and the unreliable, timing-dependent nature of the race significantly reduce real-world exploitability, and installing the vendor-supplied fixed builds (e.g. Server 2025 >=10.0.26100.33650, Windows 11 24H2 >=10.0.26100.9711) closes the window. |
| Impact | Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local privilege-escalation flaw in the LSASRV component requiring already-held low privileges and a successful win of a timing-sensitive race (CWE-362), which the High attack complexity reflects. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. SSVC framework values (exploitation/automatable/technical-impact) are also absent, so an SSVC-based decision cannot be derived. The realistic picture: a credible, patchable local EoP on an extremely widely deployed platform, gated by prior authenticated access and a hard-to-win race, making it a fleet-wide patch priority without being a drop-everything emergency absent exploitation evidence. One caveat to verify: the CVE is described and scored as elevation of privilege (I:H), yet it carries an 'Information Disclosure' tag - treat the EoP framing as authoritative over that tag. |
| Exploit ScenarioDerived | A low-privileged local user, or malware running in a standard user context, repeatedly triggers the race condition in the Local Security Authority Server to exploit the improper access-control window and elevate to SYSTEM-level privileges. Because success depends on winning a timing race (AC:H), the attacker typically loops the attempt many times until it lands. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege elevation in the Windows Local Security Authority Server (lsasrv) lets an attacker who already holds valid low-privilege local execution win a race condition inside a security-critical process and gain full confidentiality, integrity and availability impact on the affected host. Exploitation is authenticated and local only (CVSS:3.1 AV:L/PR:L/UI:N), requires no user interaction, but is gated by high attack complexity (AC:H) because the shared-resource timing window must be hit reliably; there is no remote path. There is no public exploit identified at time of analysis, and Microsoft has shipped fixed builds for all affected Windows client and server versions, so the moderate severity signal is driven primarily by the sensitivity of the LSASS component rather than by observed exploitation.
RemediationAI
Vendor-released patch: Microsoft has shipped fixed builds and the remediation is to apply the current cumulative security update for each affected platform so that the build reaches or exceeds the thresholds in the advisory - Windows Server 2025 and Windows 11 24H2 >= 10.0.26100.33650 / 10.0.26100.9711, Windows 11 25H2 >= 10.0.26200.9711, Windows 11 26H1 >= 10.0.28000.3231, Windows 11 26H2 >= 10.0.26300.9711, Windows 11 23H2 >= 10.0.22631.7652, Windows 10 21H2/22H2 >= 10.0.19044.7807, Windows 10 1809 and Windows Server 2019 >= 10.0.17763.9376, Windows 10 1607 and Windows Server 2016 >= 10.0.14393.9612, Windows Server 2022 >= 10.0.20348.5761, Windows Server 2012 >= 6.2.9200.26434 and Windows Server 2012 R2 >= 6.3.9600.23470; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87710 for the authoritative per-SKU guidance. Because the prerequisite is authenticated local execution and the exploit path is a timing-dependent race, the highest-value compensating controls are reducing who and what can execute locally: restrict interactive and secondary logon rights on multi-user and terminal-server hosts, remove unnecessary local administrator and service accounts, and prevent untrusted or user-writable code from running on domain controllers and other LSASS-sensitive systems - the trade-off is operational friction for legitimate multi-user and administrative workflows. Where immediate patching is not possible, hardening that limits the blast radius of a successful race (Credential Guard, LSA protection / RunAsPPL, ASR rules blocking credential theft and process-tampering behavior) is worth deploying, but note these are defense-in-depth measures that do not close the underlying synchronization defect and may break legacy drivers or third-party security agents that hook LSASS. Monitor for anomalous LSASS handle access, repeated rapid process/thread activity targeting lsass.exe, and unexpected token or privilege changes originating from low-privileged user contexts; after patching, reboot to ensure the updated lsasrv binary is loaded, since the old module can remain resident until restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
lsasrv is the Local Security Authority Server component that executes inside lsass.exe and is responsible for authentication, local security policy enforcement, token creation and the mediation of many security-relevant objects on a Windows host. The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), which Microsoft's advisory frames as an improper access control defect: a race window exists in which a low-privilege local caller can operate on a security-relevant resource before the LSA-side access check or synchronization completes, effectively crossing a privilege boundary. The authoritative assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H aligns exactly with that root cause - the attack surface is local only (AV:L), the actor must already be an authenticated low-privileged user on the box (PR:L), no interaction from another user is needed (UI:N), and the HIGH attack complexity (AC:H) reflects the difficulty of reliably hitting the narrow timing window rather than any lack of privileges required. Because the defect is a race, exploits are inherently unreliable and must be retried many times, which limits practical exploitation; the same property means a successful hit yields scope-unchanged but full C/I/A compromise of the host's security context, making LSASS-adjacent flaws a high-value target despite the prerequisites.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP requiring existing low privileges (AV:L, PR:L) and winning a race condition (AC:H); no user interaction, unchanged scope, full C/I/A impact as SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege-escalation flaw in the Windows Local Security Authority Subsystem (LSASS) lets an authenticated user with existing low-privilege access on a Windows host win a race condition and gain full control over that host's confidentiality, integrity, and availability. Because LSASS underpins Windows authentication and credential handling, a successful attack could turn a minor foothold or insider access into credential theft and broader lateral movement across the Windows estate. Leadership should care because the exposure spans virtually all Windows clients and servers in the organization, though exploitation is gated by high attack complexity and no public exploit code is known at this time.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB