CVE-2026-73005: Windows Authentication Methods Privilege Escalation

CVE-2026-73005 Overview

CVE-2026-73005 is a use-after-free vulnerability in Windows Authentication Methods. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. Microsoft classifies the issue under CWE-362, a concurrent execution using shared resource with improper synchronization (race condition). Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability. The attack complexity is high, and the attacker must already hold low-level privileges on the target host. Refer to the Microsoft Security Update Guide for vendor-specific product and build details.

Critical Impact
A successful race-window win lets a low-privileged local user free and reuse an authentication object, gaining elevated privileges on the host.

Affected Products

Microsoft Windows (specific builds listed in the Microsoft Security Update Guide)
Windows Authentication Methods component
Refer to the vendor advisory for full product and version coverage

Discovery Timeline

2026-09-08 - CVE-2026-73005 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73005

Vulnerability Analysis

The vulnerability is a use-after-free condition inside Windows Authentication Methods. Under [CWE-362], concurrent code paths access a shared authentication object without proper synchronization. One thread releases the object while another thread continues to reference it. The dangling reference points to memory that can be reclaimed and reshaped by the attacker.

Once the attacker controls the freed allocation, subsequent dereferences operate on attacker-influenced data. This typically enables control-flow hijack or privileged token substitution within the authentication path. The result is local privilege escalation from a standard authenticated context to a higher integrity level.

The attack requires local access, low privileges, and no user interaction. High attack complexity reflects the timing precision needed to win the race and reliably groom the heap.

Root Cause

The root cause is missing or insufficient locking around lifecycle management of an authentication object. A free operation is not serialized with concurrent readers or writers. The window between free and reallocation is exploitable by a co-resident thread.

Attack Vector

An authenticated local attacker runs code on the target Windows host. The attacker triggers the vulnerable authentication code path repeatedly while racing a second thread. Winning the race causes the kernel or service to dereference freed memory that the attacker has replaced with controlled data. See the Microsoft Security Update Guide for exploitability notes.

No public proof-of-concept exploit is available at publication time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-73005

Indicators of Compromise

Unexpected crashes or bugchecks in authentication-related services or lsass.exe on patched or unpatched hosts
New processes spawned by authentication service contexts with elevated tokens shortly after suspicious local logons
Local user accounts performing repeated, rapid authentication API calls consistent with race-window brute forcing

Detection Strategies

Monitor Windows Error Reporting and crash dumps for faults referencing authentication modules and use-after-free patterns
Correlate low-privileged process activity with subsequent creation of SYSTEM-context processes on the same host
Baseline authentication API call rates per user and alert on statistical anomalies indicating race exploitation attempts

Monitoring Recommendations

Ingest Windows Security, System, and Sysmon event logs into a centralized analytics platform for correlation
Enable process creation auditing (Event ID 4688) with command-line logging to trace privilege transitions
Track service restarts and crash events for authentication components as leading indicators of exploitation attempts

How to Mitigate CVE-2026-73005

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits
Prioritize patching multi-user hosts, terminal servers, and jump boxes where multiple local identities coexist
Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of potential attackers

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Update Guide. Consult the advisory for CVE-2026-73005 for the specific Knowledge Base articles, affected builds, and cumulative update identifiers applicable to your environment. Deploy updates through Windows Update, WSUS, Microsoft Intune, or Configuration Manager per your patching workflow.

Workarounds

No official vendor workaround is documented; patching is the supported remediation path
Restrict local logon and remote interactive logon to trusted administrators until the patch is applied
Enforce least privilege on service accounts and remove standing local shell access where operationally feasible

bash

# Verify installed updates on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Check running authentication-related services
Get-Service | Where-Object { $_.Name -match 'Netlogon|LSM|SamSs' }