CVE-2026-26155: Microsoft LSASS Information Disclosure

CVE-2026-26155 Overview

CVE-2026-26155 is a Microsoft Local Security Authority Subsystem Service (LSASS) Information Disclosure vulnerability classified under CWE-126 (Buffer Over-read). This vulnerability allows an authenticated attacker with network access to potentially extract sensitive information from the LSASS process, which is responsible for enforcing security policy on Windows systems and managing user authentication, password changes, and access token creation.

Critical Impact

Successful exploitation could allow attackers to read sensitive authentication data from LSASS memory, potentially exposing credentials, security tokens, or other sensitive information used in Windows authentication processes.

Affected Products

• Microsoft Local Security Authority Subsystem Service (LSASS)
• Windows Operating Systems with vulnerable LSASS implementations

Discovery Timeline

• April 14, 2026 - CVE-2026-26155 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26155

Vulnerability Analysis

This vulnerability stems from CWE-126: Buffer Over-read, a condition where the software reads data past the end of the intended buffer. In the context of LSASS, this over-read condition can expose sensitive authentication-related data that resides in adjacent memory regions.

The LSASS process is a critical Windows component that handles credential management, including storing password hashes and Kerberos tickets for authenticated sessions. A buffer over-read vulnerability in this service is particularly concerning because the exposed memory may contain high-value targets for attackers, such as NTLM hashes, Kerberos tickets, or plaintext credentials in certain configurations.

The network-based attack vector means that an attacker with valid credentials (low privileges required) can remotely trigger the vulnerability without requiring physical access to the target system or any user interaction.

Root Cause

The root cause is a buffer over-read condition (CWE-126) within the LSASS process. This occurs when input validation or boundary checking fails to properly constrain read operations, allowing the process to access memory beyond the allocated buffer boundaries. The over-read exposes adjacent memory contents that may contain sensitive security-related data.

Attack Vector

The attack is network-accessible and requires the attacker to have low-level authentication to the target system. Once authenticated, the attacker can exploit the buffer over-read to extract information from LSASS memory. The attack does not require user interaction and operates within unchanged scope, meaning the vulnerable component and impacted component are the same. While confidentiality is highly impacted, there is no direct impact to integrity or availability of the system.

The exploitation scenario typically involves:

1. Establishing authenticated network connectivity to the target Windows system
2. Crafting specific requests that trigger the over-read condition in LSASS
3. Capturing and analyzing the returned data for sensitive authentication information

Detection Methods for CVE-2026-26155

Indicators of Compromise

• Unusual LSASS process memory access patterns or abnormal read operations
• Network traffic anomalies targeting LSASS-related services from authenticated sessions
• Unexpected authentication-related data appearing in network captures
• LSASS crash dumps or stability issues indicating exploitation attempts

Detection Strategies

• Monitor LSASS process behavior for anomalous memory access patterns using endpoint detection tools
• Implement network-based intrusion detection rules to identify exploitation attempts targeting authentication services
• Enable Windows Security Event logging for authentication events and correlate with network activity
• Deploy SentinelOne Singularity to detect and respond to LSASS-targeting attacks in real-time

Monitoring Recommendations

• Configure Windows Defender Credential Guard where supported to provide additional LSASS protection
• Enable detailed logging for LSASS-related activities through Windows Event logging
• Implement network segmentation to limit exposure of critical authentication services
• Use SentinelOne's behavioral AI engine to detect abnormal process behavior indicative of information disclosure attacks

How to Mitigate CVE-2026-26155

Immediate Actions Required

• Apply the latest Microsoft security updates addressing CVE-2026-26155 as soon as available
• Review and restrict network access to systems running vulnerable LSASS versions
• Enable Windows Defender Credential Guard on supported Windows versions to isolate LSASS credentials
• Audit user accounts with network access privileges and enforce principle of least privilege

Patch Information

Microsoft has published security guidance for this vulnerability. Administrators should consult the Microsoft Security Update Guide for official patch information, affected product versions, and deployment guidance. Apply vendor-provided security updates through Windows Update, WSUS, or Microsoft Update Catalog as appropriate for your environment.

Workarounds

• Enable Windows Defender Credential Guard to provide hardware-based isolation for LSASS secrets
• Implement network segmentation to restrict access to systems running LSASS from untrusted network segments
• Review and remove unnecessary user accounts with network authentication capabilities
• Enable Protected Users security group membership for high-value accounts to reduce credential exposure

# Enable Credential Guard via Group Policy (Windows 10/11, Server 2016+)
# Navigate to: Computer Configuration > Administrative Templates > System > Device Guard
# Enable "Turn On Virtualization Based Security"
# Set "Credential Guard Configuration" to "Enabled with UEFI lock"

# Alternatively, enable via registry:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 1 /f