External risk intelligence

Windows LSASS Out-of-Bounds Write Allows Network Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-96219

While the vulnerability affects the Local Security Authority Subsystem Service (LSASS), which is a critical Windows component, it is designed to run locally on the operating system for security authentication and is not typically exposed directly to the public internet in standard deployment patterns.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Windows Local Security Authority Subsystem Service (LSASS). The flaw allows an unauthenticated attacker to potentially execute code remotely over a network. Given the sensitivity of LSASS, understanding the relevance of this vulnerability to our specific environment is the primary concern.

Flaw in Windows security service can allow remote code execution.
LSASS is a core component for system security.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach the vulnerable component over the network and execute code. This occurs within the Windows Local Security Authority Subsystem Service (LSASS), which handles security authentication. Successful exploitation could allow an unauthorized user to run their own code on the affected system.

No access required to start.
Triggered by network-accessible code.
Allows unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) could allow an attacker to execute code over a network. This could potentially impact system integrity and confidentiality when supported by the advisory.

System integrity and confidentiality.
Remote code execution over network.
Unauthorized code execution on system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) necessitates immediate attention from infrastructure and security teams. The first practical step is to identify all systems running LSASS, assess their network exposure and business criticality, and confirm ownership. Subsequently, a risk-based remediation plan, coordinated with vendor advisories, should be developed and executed.

Infrastructure and Security teams own remediation.
Verify LSASS network exposure and criticality.
Plan risk-based remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows LSASS component?

The Local Security Authority Subsystem Service (LSASS) is a core Windows process that enforces security policies on the system. It is responsible for managing user logins, password changes, and creating access tokens. Because it handles sensitive authentication data, it acts as a central gatekeeper for system security, making it a highly privileged and essential part of the Windows operating system.

What does CVE-2026-96219 mean by out-of-bounds write?

This vulnerability is classified as an out-of-bounds write (CWE-787). In plain terms, the software fails to properly check the boundaries of memory when processing data, allowing an attacker to write information into memory locations they should not access. In the context of CVE-2026-96219, this flaw can be leveraged by an attacker to execute their own unauthorized code on the targeted system.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker sends specifically crafted network traffic to the vulnerable LSASS component. Because the flaw exists within the network-facing processing of this service, no prior authentication is needed to initiate the attack. Importantly, normal, legitimate administrative actions or standard internal authentication traffic do not trigger this bug; it requires malicious, specially crafted inputs to exploit.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is unlikely in standard deployments. While the vulnerability allows for network-based attacks, LSASS is a system-level component designed for local authentication tasks and is rarely exposed directly to the public internet. Systems protected by standard network perimeters are generally not directly reachable by external attackers, which significantly lowers the practical risk for most environments.

What should I do first to address this CVE?

Your first step is to identify all Windows systems within your environment that run this service. Prioritize these assets based on their business criticality and verify their network placement to confirm if they are reachable over the network. Once inventoried, coordinate with your infrastructure team to monitor vendor update channels and prepare a plan to apply official security patches as soon as they are made available for your specific Windows versions.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.