Windows LSASS EUVD-2026-99748

No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation with no user interaction against default Windows configurations where LSASS is exposed to attacker-reachable network paths (e.g., SMB/authentication-related RPC surfaces). The principal limiting factors are network exposure of the vulnerable LSASS interface (hosts not reachable on the relevant ports/segments are not directly exploitable) and patch level: only the specific pre-fix build ranges enumerated in EUVD (e.g., Server 2019 <10.0.17763.9376, Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761) are affected, so a patched host is not vulnerable.

This is a genuine top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated, no-interaction code execution, and the affected component - LSASS - runs as SYSTEM, so successful exploitation yields full host compromise (C:H/I:H/A:H, score 9.8). CISA's SSVC framework corroborates the ceiling impact ('Technical Impact: total') but currently records 'Exploitation: none' and 'Automatable: no', meaning no observed exploitation and no reliable mass-scanning/weaponization path yet. These signals are consistent rather than conflicting: the ceiling is catastrophic, but the real-world exploitation signal is presently quiet. No EPSS score was provided in the input, and there is no CISA KEV listing and no public POC referenced, so the 'no public exploit identified' status is the correct read for now. The caveat worth stating explicitly: memory-corruption bugs in LSASS historically become high-value targets once a POC emerges, and SSVC's 'Automatable: no' is an initial assessment that can change - treat the current calm exploitation signal as provisional, not as evidence of low risk. Given the ubiquity of Windows and SYSTEM-level impact, patch prioritization should be immediate despite the absence of active exploitation.

A remote, unauthenticated attacker sends a crafted authentication/LSASS protocol request over the network to a vulnerable Windows host, triggering an out-of-bounds write in the LSASS process and corrupting memory to hijack execution. Because LSASS runs as SYSTEM, this results in full remote code execution without any user interaction. No public exploit code has been identified at time of analysis, so exploitation would currently require original vulnerability-research effort.