Microsoft LSASS Flaw CVE-2026-96219 Rated Critical by NVD for Remote Code Execution

Microsoft Security Update Guide identifies a critical remote code execution vulnerability in the Windows Local Security Authority Subsystem Service (LSASS), designated as CVE-2026-96219. The National Vulnerability Database assigns the flaw a CVSS score of 9.8, classifying it as critical severity based on its potential impact and exploitability characteristics.

According to the Microsoft advisory, the issue stems from an out-of-bounds write error within the LSASS component. This specific memory corruption flaw enables an unauthorized attacker to execute arbitrary code on a target system over a network. The NVD record maps this vulnerability to Common Weakness Enumeration identifier CWE-787, which categorizes out-of-bounds write errors.

Technical Context and Severity

The National Vulnerability Database provides the quantitative assessment for this defect, listing the CVSS score as 9.8. This rating places the vulnerability at the highest end of the severity spectrum. The Microsoft Security Update Guide summary aligns with the NVD description, confirming that the out-of-bounds write in LSASS facilitates remote code execution.

The designation of "unauthorized attacker" in the Microsoft summary indicates that the exploit does not require prior valid credentials on the target machine to initiate the code execution attempt. The combination of network accessibility and the critical nature of the LSASS component contributes to the high severity rating assigned by the NVD.

Affected Components and Scope

The vulnerability specifically impacts the Windows Local Security Authority Subsystem Service, a core Windows component responsible for enforcing security policies and managing user logins. Because LSASS runs with high privileges, an out-of-bounds write in this service can lead to full system compromise if successfully exploited.

The NVD record lists the affected component as Windows LSASS but does not specify particular Windows versions or build numbers in the provided metadata. Microsoft typically details affected operating system versions in the full advisory text on the Microsoft Security Response Center website, which is linked in the update guide.

What should you do?

Security professionals should monitor the Microsoft Security Response Center for detailed mitigation guidance and patch releases associated with CVE-2026-96219. Until a specific fix or workaround is published, organizations should review network segmentation policies to limit lateral movement potential.

What to do and how to stay safe: Microsoft

• Check the Microsoft Security Update Guide for specific Windows versions affected by CVE-2026-96219 and prioritize patching those systems once an update is available.
• Implement strict network segmentation to restrict access to systems running LSASS, reducing the attack surface for unauthorized network-based exploitation attempts.
• Monitor LSASS process activity for anomalous behavior or unexpected memory writes, which could indicate an attempt to exploit the out-of-bounds write vulnerability.
• Review firewall rules and intrusion detection signatures to block suspicious network traffic targeting the ports and services used by the Local Security Authority Subsystem Service.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96219?

The National Vulnerability Database rates CVE-2026-96219 as critical with a CVSS score of 9.8.

What type of vulnerability is CVE-2026-96219?

It is an out-of-bounds write vulnerability in the Windows Local Security Authority Subsystem Service (LSASS).

Can this vulnerability be exploited remotely?

Yes, Microsoft states that an unauthorized attacker can execute code over a network using this flaw.