CVE-2026-49799

What it actually does

CVE-2026-49799 is an uncontrolled resource consumption vulnerability in Windows Local Security Authority Subsystem Service, LSASS. An authenticated attacker with network access can send crafted or excessive requests that cause LSASS to consume excessive CPU, memory, handles, threads, or related system resources. Because LSASS is responsible for authentication and security policy enforcement, resource exhaustion can make the system unable to process logons or security operations and may cause LSASS instability or system restart behavior. The impact is availability-only: the published vector does not indicate data disclosure or privilege escalation.

Why it matters to the business

Successful exploitation can disrupt authentication-dependent services on affected Windows clients and servers, including domain-joined systems, application servers, remote access, and administrative access. On servers, especially domain controllers or identity-adjacent infrastructure, this may result in widespread login failures, service outages, failed scheduled jobs, and operational downtime. The CVSS score is moderate, EPSS is currently low, and it is not listed in CISA KEV, but the network-reachable, low-complexity nature means organizations should still prioritize patching systems that provide authentication, remote access, or critical business services.

How an attack unfolds

An attacker first obtains valid credentials or otherwise reaches a state where they can authenticate to a vulnerable Windows system over the network. They then connect to an exposed Windows authentication or security service path that causes LSASS to process attacker-controlled requests. By repeatedly sending crafted requests or driving request volume in a way LSASS fails to bound correctly, the attacker forces LSASS to consume excessive resources. As resource pressure increases, authentication operations slow, fail, or time out; in more severe cases LSASS may become unresponsive or terminate, which can trigger service disruption or a system restart. Because exploitation requires privileges but no user interaction and low attack complexity, compromised low-privilege accounts may be sufficient to create outages against reachable vulnerable systems.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49799 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. No explicit fixed build numbers were provided in the input, so administrators should use the applicable Microsoft cumulative update or security-only update for the affected release channel. Prioritize domain controllers, identity infrastructure, remote desktop hosts, file servers, application servers, and internet- or partner-reachable Windows systems. Where immediate patching is not possible, reduce exposure by restricting network access to authentication and management services, limiting SMB/RPC/RDP access to trusted networks, enforcing least privilege, disabling unused services, and monitoring for abnormal LSASS resource consumption. Ensure systems have sufficient endpoint telemetry and crash reporting enabled before and after remediation.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft update corresponding to the advisory for CVE-2026-49799. Validate through Windows Update history, enterprise patch management inventory, or PowerShell queries such as reviewing installed hotfixes and OS build levels against Microsoft’s release notes. After patching, reboot where required and confirm LSASS remains stable under normal authentication load. Perform controlled validation only in a test environment by exercising normal network logon, SMB, RPC, RDP, and domain authentication workflows while monitoring LSASS CPU, memory, handle count, and event logs. For exposure validation, inventory systems running affected Windows versions and identify hosts where network authentication services are reachable from untrusted or broad internal network segments.

Typical attack path

1. Identify Windows systems reachable over the network that expose authentication-related services such as domain logon, SMB, RPC, or remote management paths.
2. Obtain or use existing valid credentials for an account authorized to interact with the target over the network.
3. Send crafted or high-volume authentication/security requests that are processed by LSASS.
4. Cause LSASS resource usage to spike, resulting in degraded authentication performance, logon failures, or LSASS instability.
5. Sustain or repeat the request pattern to prolong denial of service and disrupt dependent applications, users, or administrative access.

How to detect it

Look for evidence of LSASS instability or resource exhaustion correlated with authenticated network activity. Useful log sources include Windows System, Security, and Application event logs; Windows Error Reporting; endpoint detection telemetry; Sysmon if deployed; performance monitoring; domain controller security logs; SMB/RPC/RDP logs; firewall or network flow records; and crash dump directories. Investigate Event ID 1000 or 1001 entries involving lsass.exe, unexpected system restarts following LSASS failure, Service Control Manager messages, spikes in failed or successful network logons, and repeated authentication attempts from a small number of source IPs or accounts. On domain controllers, look for bursts of Kerberos, NTLM, SMB, RPC, or logon activity immediately before LSASS CPU or memory spikes. For forensic review, preserve LSASS-related crash dumps, Windows Error Reporting artifacts, event logs, memory metrics, and network connection telemetry around the outage window. Since this is a denial-of-service issue, indicators are more likely to be behavioral than file-based; absence of malware artifacts does not rule out exploitation.

• lsass.exe
• Faulting application name: lsass.exe
• Faulting process name: lsass.exe
• The Local Security Authority process has terminated unexpectedly
• Local Security Authority Subsystem Service
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Event ID 4624
• Event ID 4625
• Event ID 4648
• Event ID 4771
• Event ID 4776
• Event ID 7031
• Event ID 7034
• Event ID 1074
• C:\Windows\System32\lsass.exe
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• lsass.exe high CPU
• lsass.exe high memory

What your security team should do

• Patch domain controllers and identity-critical Windows servers first, followed by externally reachable, remote-access, file, application, and administrative management servers.
• Inventory affected Windows 10, Windows 11, and Windows Server versions and track remediation status through centralized patch management.
• Restrict network access to SMB, RPC, RDP, WinRM, and domain authentication paths to trusted administrative and application networks only.
• Review account hygiene and reduce the number of low-privilege accounts that can authenticate broadly across servers.
• Create detections for LSASS crashes, LSASS restarts, unexpected reboots, authentication failure spikes, and abnormal LSASS CPU or memory consumption.
• Correlate LSASS instability with preceding network logons, SMB/RPC/RDP activity, and source IPs generating unusually high authentication volume.
• Establish operational playbooks for isolating a host experiencing LSASS-driven denial of service while preserving event logs, crash dumps, and endpoint telemetry.
• Because EPSS is currently low and there is no KEV listing, treat this as priority patching for critical Windows infrastructure rather than an emergency internet-wide exploitation event unless local telemetry shows active abuse.