Windows SAM CVE-2026-96858

Exploitation requires the attacker to already hold a local, authenticated session on the affected Windows host (PR:L, AV:L) - it cannot be triggered remotely or by an unauthenticated user. The specific trigger is invoking the affected Security Account Manager (SAM) critical function that is missing an authentication/authorization check (CWE-306), enabling local tampering of integrity-sensitive account data. Limiting factors: local access is mandatory, the host must be running an unpatched in-range build (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650, Windows 10 22H2 before 10.0.19044.7807), and only integrity is affected - there is no direct data disclosure or denial of service. No non-default configuration is indicated by the available data.

This is a moderate, locally-exploitable integrity flaw, not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a local attack (AV:L) by an already-authenticated low-privilege user (PR:L) with low complexity and no user interaction, impacting integrity only (I:H) with no confidentiality or availability effect. All exploitation signals point low: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; there is no CISA KEV listing and no public exploit was identified in the provided data. The signals are internally consistent - a local, authenticated tampering primitive against the Security Account Manager that is not automatable and not observed in the wild aligns with a 'patch on normal cycle' priority rather than an emergency. EPSS was not provided, so widespread-exploitation probability cannot be quantified. The 'Authentication Bypass' tag plus CWE-306 (missing authentication for a critical function) describes the weakness mechanism, but the CVSS PR:L confirms the attacker must already hold a local authenticated foothold, so this is a privilege/integrity escalation issue rather than a pre-authentication remote bypass - verify this nuance against the Microsoft MSRC advisory.

A low-privileged authenticated user on a Windows host locally invokes a SAM function that fails to properly authenticate the caller, allowing them to tamper with account-manager data they should not be able to modify. No user interaction is required and attack complexity is low, but the attacker must already have local, authenticated access to the machine. No public exploit code was identified at the time of analysis.