Key points
- CVE-2026-96219 affects the Windows Local Security Authority Subsystem Service.
- The flaw allows unauthenticated remote code execution via an out-of-bounds write.
- The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.
A critical vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) exposes systems to remote code execution. Microsoft’s Security Update Guide identifies CVE-2026-96219 as an out-of-bounds write flaw that allows an unauthorized attacker to execute code over a network. The National Vulnerability Database assigns the issue a CVSS score of 9.8, classifying it as critical. This high severity reflects the remote nature of the attack vector and the lack of required authentication for exploitation.
The flaw is an out-of-bounds write in the Windows Local Security Authority Subsystem Service. According to the NVD record, the weakness is categorized under CWE-787. The source material states that this defect allows an unauthorized attacker to execute code over a network. Because the attack vector is network-based and requires no authentication, exposed machines are at risk. Developers and system administrators must prioritize remediation to prevent unauthorized code execution via this specific vulnerability.
What we know
Microsoft’s official advisory confirms the technical nature of the defect as an out-of-bounds write within the LSASS service. The summary explicitly states that this allows an unauthorized attacker to execute code over a network. The NVD entry mirrors this description, reinforcing the remote execution capability. No specific Windows versions are listed in the provided source material, but the flaw is tied directly to the core security service. The absence of authentication requirements means any machine with network exposure to the vulnerable service is a potential target for exploitation.
Defender's checklist
- Verify if your Windows systems are running the affected LSASS component.
- Monitor network logs for unusual traffic targeting the LSASS service ports.
- Ensure your vulnerability scanning tools have updated signatures for CVE-2026-96219.
- Review access controls to limit network exposure of critical security services.
What analysts watch for
Security teams usually monitor for anomalous network connections targeting the LSASS service. Analysts check for unexpected process injections or memory writes that do not match normal system behavior. They examine crash dumps for out-of-bounds write indicators and review firewall logs for unauthenticated attempts to reach critical ports. Teams also look for lateral movement patterns that suggest an attacker has gained initial foothold through such a flaw. Persistence mechanisms often involve creating new user accounts or modifying security policies.
Background: Vulnerability scanning
Vulnerability scanning is automated detection of known flaws, while penetration testing is manual exploitation of those flaws. Scanning gives you a list of risks; testing proves which risks an attacker can actually use. You need scanning for routine checks and testing for deep validation of your security posture.
Read the full guide: Pen Testing vs Vulnerability Scanning: The Real Difference
What to do and how to stay safe: Microsoft
- Isolate affected systems from the network to prevent further exploitation while awaiting patches.
- Apply the latest security updates from Microsoft as soon as they become available.
- Restrict network access to the LSASS service using firewall rules and segmentation.
- Monitor system logs for signs of unauthorized code execution or privilege escalation attempts.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-96219?
It is a critical out-of-bounds write vulnerability in the Windows LSASS service that allows remote code execution.
How severe is this vulnerability?
The NVD rates it as critical with a CVSS score of 9.8.
Does the attacker need authentication?
No, the source material states the flaw allows an unauthorized attacker to execute code over a network.
