Windows LSASS EUVD-2026-99441

Exploitation targets the Windows Local Security Authority Subsystem Service (LSASS) over a network interface; the attacker must be able to reach the vulnerable LSASS-facing service on an unpatched Windows build (see EUVD affected ranges, e.g. Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650, down to Server 2012). Limiting factors: the CVSS vector specifies PR:L, so a low-privilege authenticated position appears required (though the description's 'unauthorized attacker'/CWE-306 wording contradicts this and should be confirmed with Microsoft); no user interaction is needed (UI:N) and complexity is low (AC:L). CISA SSVC marks the flaw non-automatable, indicating exploitation is not trivially scriptable at scale. The host must be unpatched - the fix is available from Microsoft.

This is a serious but not top-of-queue issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a low-complexity network attack requiring only low privileges, with total CIA impact (C:H/I:H/A:H) in an unchanged scope, yielding 8.8 (High) - fitting for memory-corruption RCE in LSASS, a core Windows security process. However, exploitation signals are weak and partly conflicting: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' (Technical Impact 'total'), no CISA KEV listing is present, and no public PoC is indicated, so there is no public exploit identified at time of analysis. A notable data conflict exists: the description calls this an 'unauthorized attacker' and the CWE is CWE-306 (Missing Authentication for Critical Function), implying no credentials needed, yet the CVSS vector specifies PR:L (authenticated/low-privilege) - these cannot both be literally true, so the real privilege prerequisite should be verified against the Microsoft MSRC advisory. Net: treat as a high-priority patch target given ubiquity of Windows and total impact in LSASS, but current intelligence points to no active or automatable exploitation, making this an urgent-patch rather than emergency-exploitation scenario.

An attacker with network reach to a Windows host's LSASS-exposed interface sends a crafted message that triggers an out-of-bounds write in LSASS, corrupting memory to achieve arbitrary code execution in this highly privileged security process. Per the CVSS vector this requires low complexity (AC:L) and, despite the 'unauthorized' wording, low privileges (PR:L) with no user interaction. No public exploit code is identified at time of analysis, and CISA SSVC rates it non-automatable, suggesting any exploitation would be bespoke rather than commoditized.