CVE-2026-32071

What it actually does

CVE-2026-32071 is a network-reachable denial-of-service vulnerability in Windows Local Security Authority Subsystem Service (LSASS). An unauthenticated remote attacker can trigger a null pointer dereference in LSASS, causing the LSASS process to crash. Because LSASS is a critical Windows process responsible for authentication, credential handling, security policy enforcement, and domain security functions, a crash typically causes system instability and may force an automatic restart. The CVSS vector indicates low attack complexity, no privileges required, no user interaction, and high availability impact, with no direct confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can interrupt Windows authentication and make affected workstations, servers, or domain controllers temporarily unavailable. On domain controllers or authentication-heavy servers, this can cause widespread login failures, application outages, failed service authentication, and operational disruption. The vulnerability is not currently listed in CISA KEV, is not reported as ransomware-used, has low and stable EPSS, and has no known public exploit maturity in the supplied data; however, because it is unauthenticated and network-accessible, exposed or business-critical Windows systems should still be patched in normal high-priority maintenance windows.

How an attack unfolds

An attacker identifies a reachable Windows system running an affected Windows client or server version. The attacker sends specially crafted network traffic to a Windows service path that is handled by LSASS or invokes LSASS-backed authentication/security processing. The malformed request causes LSASS to dereference a null pointer, resulting in a process crash. Since LSASS is critical to Windows operation, the affected host may reboot or become unable to process authentication correctly until recovery. An attacker can repeat the activity to create recurring outages, particularly against systems that provide authentication or centralized Windows services.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-32071 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no exact fixed build or KB is provided in the input, use the Microsoft Security Update Guide for CVE-2026-32071 and confirm that the relevant April 2026 or later cumulative security update is installed for each supported Windows release. Prioritize domain controllers, identity infrastructure, internet-exposed Windows servers, remote access infrastructure, and systems that process high volumes of authentication traffic. Where immediate patching is not possible, reduce exposure by restricting inbound Windows authentication, SMB, RPC, LDAP, Kerberos, Netlogon, and management traffic to trusted networks only; enforce host firewalls and network segmentation; remove unnecessary public exposure; and ensure high-availability coverage for authentication services.

How to confirm the fix worked

Confirm remediation by verifying that affected Windows systems have the applicable Microsoft cumulative security update installed and that OS build numbers match or exceed the fixed build listed by Microsoft for each release. Use vulnerability scanners authenticated to Windows hosts where possible, and corroborate with Windows Update history, installed hotfix/KB inventory, endpoint management tooling, and OS build reporting. After patching, monitor for absence of recurring LSASS crashes, unexpected reboots, Windows Error Reporting entries for lsass.exe, and Service Control Manager events showing LSASS termination. For exposure validation, confirm that Windows authentication and management ports are not reachable from untrusted networks unless explicitly required and protected.

Typical attack path

1. Scan for reachable Windows hosts exposing authentication or Windows networking services.
2. Identify systems running affected Windows client or server versions.
3. Send a malformed unauthenticated network request that reaches LSASS-backed processing.
4. Trigger the null pointer dereference and crash LSASS.
5. Cause authentication failure, service disruption, or system restart.
6. Repeat the traffic to sustain denial of service until the system is patched or access is filtered.

How to detect it

Look for evidence of LSASS process crashes, unexpected system restarts, and repeated authentication-service failures around the same time as unusual inbound network traffic. Primary log sources include Windows System logs, Windows Application logs, Windows Error Reporting, endpoint detection telemetry, crash dump directories, firewall logs, domain controller logs, VPN/perimeter logs, and network flow data. In Windows Application logs, search for Application Error or Windows Error Reporting events involving lsass.exe. In Windows System logs, look for Service Control Manager events indicating the Local Security Authority process terminated unexpectedly, system restart events shortly after LSASS failure, or bugcheck events. On domain controllers, correlate LSASS crashes with spikes in failed logons, authentication timeouts, LDAP/Kerberos/Netlogon errors, or sudden client reconnection storms. Network telemetry should be reviewed for repeated unauthenticated inbound attempts to Windows authentication or management services immediately before crashes. Since no public exploit signature or payload indicator is provided, detection should focus on behavioral artifacts: repeated lsass.exe faults, clustered host reboots, service-control events, and source IPs repeatedly communicating with affected hosts just before LSASS failure.

• lsass.exe
• Local Security Authority Process
• Local Security Authority Subsystem Service
• The Local Security Authority Process service terminated unexpectedly
• Faulting application name: lsass.exe
• Faulting module name: lsasrv.dll
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 1074
• Event ID 6008
• Event ID 41
• C:\Windows\System32\lsass.exe
• C:\Windows\Minidump\
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue\

What your security team should do

• Patch domain controllers and authentication-critical Windows servers first, followed by internet-facing Windows systems and then the remaining affected workstation/server fleet.
• Use Microsoft Security Update Guide to identify the exact KB/build required for each affected Windows version because fixed versions were not supplied in the input.
• Run authenticated vulnerability scans and endpoint inventory checks to identify unpatched Windows 10, Windows 11, and Windows Server systems.
• Restrict inbound access to Windows authentication and management services from untrusted networks, especially SMB, RPC, LDAP, Kerberos, Netlogon, and remote administration paths.
• Monitor Windows System and Application event logs for LSASS crashes, automatic restarts, Windows Error Reporting for lsass.exe, and clustered timing across multiple hosts that may indicate deliberate denial-of-service activity.
• For domain controllers, confirm redundancy, replication health, and failover capacity so a single LSASS crash does not create a broader authentication outage.
• Treat repeated LSASS crashes from similar source networks as a security incident even though the issue is denial-of-service rather than code execution.