CVE-2026-96219: Windows LSASS RCE Vulnerability

CVE-2026-96219 Overview

CVE-2026-96219 is an out-of-bounds write vulnerability [CWE-787] in the Windows Local Security Authority Subsystem Service (LSASS). The flaw allows an unauthenticated attacker to execute arbitrary code over a network. Microsoft published the advisory on October 13, 2026, and classified the issue as critical with a CVSS 3.1 base score of 9.8.

LSASS runs as a high-privilege system process responsible for authentication, token issuance, and local security policy enforcement. Successful exploitation grants attackers code execution in a security-critical context without any user interaction or prior credentials.

Critical Impact
Unauthenticated remote code execution in LSASS can lead to full system compromise, credential theft, and lateral movement across Active Directory environments.

Affected Products

Microsoft Windows (specific builds listed in the Microsoft Security Update Guide)
Windows Server editions running LSASS with network-exposed authentication services
Domain-joined endpoints reachable over authentication protocols

Discovery Timeline

2026-10-13 - CVE-2026-96219 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96219

Vulnerability Analysis

The vulnerability resides in LSASS, the user-mode process (lsass.exe) that handles Windows authentication, Kerberos ticket processing, NTLM, and Security Account Manager (SAM) operations. An out-of-bounds write occurs when LSASS processes attacker-controlled input and writes data past the end of an allocated buffer.

Because LSASS is reachable through network authentication paths, a remote attacker can trigger the flaw without authenticating first. Memory corruption inside LSASS can be leveraged to overwrite function pointers, control structures, or heap metadata, enabling arbitrary code execution in the LSASS process context.

The EPSS probability is 0.893%, reflecting early-stage exploitation likelihood. However, LSASS-reachable network bugs have historically been weaponized quickly once technical details become public.

Root Cause

The underlying weakness is classified as [CWE-787] Out-of-bounds Write. LSASS fails to properly validate the size or offset of attacker-supplied data before writing to a destination buffer. This boundary condition error permits adjacent memory corruption during authentication-related message parsing.

Attack Vector

The attack vector is network-based with low complexity. An attacker sends a crafted authentication request or protocol message to a vulnerable Windows host exposing LSASS-backed services. No privileges and no user interaction are required. Successful exploitation compromises confidentiality, integrity, and availability of the target.

No public proof-of-concept exploit is currently referenced in the enriched data, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Technical details are documented in the Microsoft Security Update Guide for CVE-2026-96219.

Detection Methods for CVE-2026-96219

Indicators of Compromise

Unexpected crashes or restarts of lsass.exe recorded in Windows Error Reporting (WER) or Application event log entries
Anomalous inbound traffic to authentication-related ports (SMB 445, Kerberos 88, LDAP 389/636, RPC endpoints)
Child processes spawned by lsass.exe that are not part of normal Windows behavior
Memory read access attempts against LSASS from non-system processes following suspicious network activity

Detection Strategies

Monitor for process integrity violations and unusual thread creation inside lsass.exe
Correlate network authentication traffic with LSASS stability events to detect exploitation attempts
Deploy behavioral endpoint detection that identifies memory corruption patterns and post-exploitation activity such as credential dumping or token manipulation
Enable Windows Defender Credential Guard where supported to raise the exploitation bar

Monitoring Recommendations

Ingest Windows Security, System, and Application event logs into a centralized SIEM for correlation
Alert on lsass.exe crash events (Event ID 1000, 1001) occurring in clusters across hosts
Track outbound connections initiated by lsass.exe, which are rare in normal operation
Audit authentication protocol telemetry for malformed packets and repeated protocol errors

How to Mitigate CVE-2026-96219

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-96219 on all affected Windows systems
Prioritize patching domain controllers, authentication servers, and internet-exposed Windows hosts
Restrict network access to LSASS-backed services (SMB, RPC, LDAP, Kerberos) from untrusted networks using host and perimeter firewalls
Validate backups and recovery procedures before patching production authentication infrastructure

Patch Information

Microsoft released a security update addressing CVE-2026-96219 on October 13, 2026. Administrators should consult the Microsoft Security Update Guide for the specific KB article and update package matching each affected Windows build. Install the update through Windows Update, WSUS, Microsoft Update Catalog, or the organization's standard patch management workflow.

Workarounds

Block inbound SMB (TCP 445) and legacy authentication protocols at the network perimeter where feasible
Enforce network segmentation to isolate domain controllers and limit lateral authentication traffic
Enable Protected Process Light (PPL) for LSASS and Credential Guard to reduce post-exploitation impact
Disable unused authentication services and legacy protocols such as NTLMv1 where business requirements allow

bash

# Enable LSASS as a Protected Process (PPL) via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

# Verify the setting
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL

# Reboot to apply
shutdown /r /t 0