CVE-2026-49799 Overview
CVE-2026-49799 is a denial-of-service vulnerability in the Windows Local Security Authority Subsystem Service (LSASS). The flaw stems from uncontrolled resource consumption [CWE-400] within LSASS, which handles authentication, security policy enforcement, and access token generation on Windows systems. An authenticated attacker with network access can send crafted requests that exhaust LSASS resources, causing service disruption. Because LSASS is a critical Windows component, its failure can trigger system instability or forced reboots. The vulnerability affects a broad set of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025.
Critical Impact
An authenticated network attacker can cause LSASS to consume excessive resources, leading to denial of service on Windows endpoints and domain-critical servers.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-49799 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-49799
Vulnerability Analysis
The vulnerability resides in lsass.exe, the process responsible for enforcing security policies, validating logons, and handling Kerberos and NTLM authentication. An authenticated attacker can send a sequence of specially crafted authentication or RPC requests over the network. These requests trigger uncontrolled allocation of memory, handles, or CPU cycles within LSASS. Because LSASS is a protected system process, its failure typically results in an automatic system shutdown or reboot on Windows clients and servers. The attack requires low privileges and no user interaction, and it can be launched remotely against any reachable Windows host exposing authentication endpoints.
Root Cause
The root cause is improper enforcement of resource limits inside LSASS request handling, categorized under [CWE-400] Uncontrolled Resource Consumption. LSASS fails to bound the resources consumed while processing certain authenticated network requests, allowing an attacker to force the service into exhaustion.
Attack Vector
Exploitation requires network reachability to an LSASS-exposed service, such as SMB, RPC, or LDAP endpoints, and valid low-privilege credentials. Domain controllers are particularly exposed because they must accept authentication traffic from all domain members. Successful exploitation denies authentication services domain-wide until the affected host recovers.
No public proof-of-concept or verified exploit code is available at the time of publication. Refer to the Microsoft Security Update CVE-2026-49799 for authoritative technical details.
Detection Methods for CVE-2026-49799
Indicators of Compromise
- Unexpected termination or repeated restarts of lsass.exe recorded in the Windows System event log (Event IDs 1074, 6008, or WER crash reports).
- Sustained high memory, handle count, or CPU utilization by lsass.exe on domain controllers or member servers.
- Bursts of failed or malformed authentication requests from a single authenticated source over SMB, RPC, or LDAP.
Detection Strategies
- Baseline LSASS resource usage per host and alert on deviations that exceed normal working-set or handle counts.
- Correlate authentication traffic volume with LSASS process health to identify resource-exhaustion patterns tied to a specific principal.
- Monitor for Service Control Manager events indicating LSASS crash-triggered shutdowns.
Monitoring Recommendations
- Ingest Windows Security, System, and WER event logs into a centralized analytics platform for cross-host correlation.
- Track authenticated RPC and LDAP call rates per user account and flag anomalous spikes against domain controllers.
- Alert on repeated lsass.exe termination events across multiple hosts within short time windows, which may indicate an active DoS campaign.
How to Mitigate CVE-2026-49799
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory to all affected Windows client and server builds.
- Prioritize patching domain controllers and any internet-facing Windows hosts that accept authentication traffic.
- Audit accounts with network logon rights and revoke credentials that are unnecessary or over-privileged.
Patch Information
Microsoft has published fixes through the standard Windows Update channel. Review the Microsoft Security Update CVE-2026-49799 advisory for the KB numbers that map to each affected Windows build, and deploy through WSUS, Intune, or your preferred update mechanism.
Workarounds
- Restrict network exposure of SMB, RPC, and LDAP ports (135, 139, 445, 389, 636) to trusted management networks using host and perimeter firewalls.
- Enforce authentication rate limiting and account lockout policies to slow attackers reusing low-privilege credentials.
- Segment domain controllers behind a tiered administration model to reduce the pool of accounts that can initiate authenticated network requests.
# Example: restrict inbound LDAP and SMB to a management subnet using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict LDAP to Mgmt" -Direction Inbound `
-Protocol TCP -LocalPort 389,636 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block LDAP Elsewhere" -Direction Inbound `
-Protocol TCP -LocalPort 389,636 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
