{"id":"CVE-2026-96219","published":"2026-10-13T19:21:47.737","lastModified":"2026-10-16T16:22:46.130","description":"Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":["microsoft"],"products":["windows 10 1809","windows 10 21h2","windows 10 22h2","windows 11 23h2","windows 11 24h2","windows 11 25h2","windows 11 26h1","windows 11 26h2","windows server 2019","windows server 2022","windows server 2025"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96219","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An out-of-bounds write vulnerability in Windows LSASS allows remote attackers to execute arbitrary code with high privileges. This flaw occurs when LSASS processes authentication requests, potentially enabling full system compromise without requiring user interaction.","exploitability":"Exploitation is likely straightforward for remote attackers with minimal preconditions, as the vulnerability exists in the core authentication service and can be triggered over the network without authentication.","blast_radius":"If exploited, this vulnerability could impact all Windows systems running LSASS, potentially allowing attackers to gain domain administrator privileges and move laterally across the entire network infrastructure.","remediation":"Apply the latest Windows security updates immediately, specifically the patch released in the August 2026 Update KB5067890 or later.","detection":"Monitor for unusual LSASS process memory access patterns and unexpected authentication failures in Security Event Logs (Event ID 4624) that occur during high-volume authentication requests.","tags":["rce","auth","windows","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:51:20.746Z"}}