CVE-2026-40378

What it actually does

This is a network-reachable denial-of-service vulnerability in Windows Local Security Authority Subsystem Service (LSASS). An unauthenticated attacker can send crafted network input that causes LSASS to attempt a memory allocation using an excessively large size value. The result is resource exhaustion or LSASS failure, which can disrupt authentication, logon processing, domain-related security operations, and in many Windows configurations may cause service instability or a system restart. The flaw does not provide code execution, privilege escalation, or data disclosure based on the available description; the primary impact is loss of availability.

Why it matters to the business

Successful exploitation can make affected Windows workstations or servers temporarily unavailable or unable to process authentication requests. On domain controllers or identity-adjacent servers, this can affect many dependent users and applications at once because LSASS is central to Windows authentication. Although EPSS is currently low and stable, the vulnerability is network-accessible, requires no credentials or user interaction, and affects many supported Windows client and server versions, so organizations should treat exposed or high-criticality Windows systems as a priority for patching.

How an attack unfolds

An attacker first identifies a reachable Windows system exposing network services that interact with LSASS, such as Windows authentication, RPC, SMB, domain, or related security interfaces. The attacker then sends specially crafted network traffic that reaches LSASS and supplies an excessive size value during memory allocation handling. Vulnerable systems attempt to allocate an abnormal amount of memory or otherwise enter an unstable condition, causing LSASS to fail, consume resources, or trigger broader operating system instability. The practical outcome is denial of service: users may be unable to authenticate, active sessions may be disrupted, and servers may become unavailable until the service or operating system recovers or is restarted. There is no public indication in the supplied data of active exploitation, ransomware use, or known exploit maturity.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-40378 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. Because exact fixed build numbers were not provided, use the Microsoft Security Update Guide and Windows Update/WSUS/Intune/SCCM compliance data to confirm that the July 2026 or later cumulative update containing this fix is installed for each affected product. Prioritize domain controllers, internet-facing Windows servers, VPN/RDS-adjacent systems, and servers that provide authentication-dependent business services. Where immediate patching is not possible, reduce exposure by restricting inbound access to Windows authentication and management services to trusted networks only, blocking unnecessary SMB/RPC/Netlogon/LDAP/Kerberos exposure at network boundaries, enforcing host firewalls, and monitoring for LSASS instability. Mitigations should be considered temporary; patching is the durable fix.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Use centralized patch management, vulnerability scanners, endpoint management tools, or authenticated configuration checks to validate OS build and update level against Microsoft’s official fixed guidance. Validate that high-risk systems such as domain controllers and authentication servers are patched first. Confirm that unnecessary inbound access to SMB, RPC, LDAP, Kerberos, and related Windows services is blocked from untrusted networks. After patching, monitor for recurring LSASS crashes, Windows Error Reporting events, System log service-termination events, unexpected restarts, and authentication outages to ensure the issue is no longer observable.

Typical attack path

1. Scan for reachable Windows hosts exposing authentication-related network services such as SMB, RPC, Kerberos, LDAP, or domain controller services.
2. Select affected Windows client or server versions that have not received the relevant Microsoft security update.
3. Send crafted unauthenticated network requests designed to trigger excessive memory allocation in LSASS.
4. Cause LSASS resource exhaustion, crash, or system instability.
5. Repeat requests as needed to sustain authentication failure or host/service unavailability.

How to detect it

To determine whether exploitation may already have occurred, review Windows Event Logs and endpoint telemetry for LSASS crashes, abnormal memory exhaustion, unexpected restarts, and authentication service disruption. Focus on System, Application, Security, Windows Error Reporting, Sysmon, EDR process telemetry, firewall logs, and network IDS/flow records. Look for Event ID 1000 or 1001 involving lsass.exe, Service Control Manager events showing the Local Security Authority process or dependent services terminated, unexpected reboot events shortly after LSASS failures, and authentication failure spikes from a small number of remote sources. On domain controllers, correlate LSASS instability with bursts of inbound connections to SMB/RPC/Kerberos/LDAP/Netlogon services. Network evidence alone may not uniquely identify this vulnerability, so prioritize correlation between suspicious inbound traffic and LSASS crash or resource-exhaustion artifacts. There are no supplied threat actors, KEV listing, ransomware association, or public exploit indicators, so detections should focus on behavioral signs of attempted denial of service rather than a known exploit string.

• lsass.exe
• C:\Windows\System32\lsass.exe
• Faulting application name: lsass.exe
• Faulting module name: lsass.exe
• Local Security Authority Subsystem Service
• The Local Security Authority process has failed
• A critical system process, C:\Windows\system32\lsass.exe, failed
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 7031
• Event ID 7034
• Event ID 6008
• Event ID 1074
• Event ID 41
• port 445
• port 135
• port 139
• port 389
• port 636
• port 88
• port 464

What your security team should do

• Prioritize patching domain controllers, authentication infrastructure, and externally reachable Windows servers before standard workstations.
• Use authenticated vulnerability scanning or endpoint management reporting to identify affected Windows versions missing the relevant Microsoft security update.
• Restrict untrusted network access to SMB, RPC, Kerberos, LDAP, Netlogon, and other Windows authentication-related services, especially across internet, VPN, partner, and user VLAN boundaries.
• Create temporary detections for LSASS crashes, unexpected restarts, memory exhaustion, and authentication failure spikes while patch rollout is in progress.
• Review firewall and segmentation rules to ensure domain controller and server management ports are reachable only from required administrative and application networks.
• Because current EPSS is low, not in KEV, and exploit maturity is listed as none, align urgency with exposure and criticality, but do not defer patching for identity-critical systems.