Windows: Denial of service in Security Account Manager

Summary

An uncontrolled resource consumption flaw (CWE-407) in the Windows Security Account Manager (SAM) allows an unauthenticated remote attacker to deny service on affected Windows systems. No privileges or user interaction are required and the attack complexity is low. Confidentiality and integrity are not affected, but availability is. Exposure depends on whether affected hosts can be reached from untrusted networks.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019 incl. Server Core (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025: Unknown (listed only by a third-party tracker, not confirmed by MSRC)

Fixed in

• Fixed builds per the CNA record: 10.0.14393.9688 (1607, Server 2016), 10.0.17763.9487 (1809, Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.28000.3501 (26H1), 10.0.26300.9974 (26H2), 10.0.20348.5870 (Server 2022)
• Fix is delivered via a Windows security update. KB numbers: Unknown until verified on MSRC.

Workaround

• Unknown. No vendor workaround was found in the sources reviewed.
• Until patched, restrict network access to affected hosts and block unnecessary inbound management, RPC and SMB access. This is general hardening, not a Microsoft-documented mitigation for this CVE.

Exploitation

• No evidence of exploitation in the wild was found.
• Microsoft's CVE record vector includes E:U (exploit maturity unproven).
• CISA SSVC: Exploitation none, automatable yes, technical impact partial.
• VulDB reports no available exploit (tracker assessment).

Our recommendation

• Inventory all Windows 10 and Windows Server hosts and compare their build numbers with the fixed builds above.
• Check support and ESU status; unsupported builds such as 1607, 1809, 21H2 and 22H2 will not receive the fix and need upgrading or isolation.
• Confirm the KB for the November 2026 update on the MSRC page and apply it, prioritising servers and internet-facing or branch/guest-reachable systems.
• Restrict network reachability of affected hosts until patched.
• Monitor exposed hosts for crashes, service hangs or unusual SAM-related errors.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-112966 msrc.microsoft.com
• CVE Record (CVE Program) www.cve.org
• VulDB entry 434883 vuldb.com
• Strix AI tracker (secondary, unconfirmed product list) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:57.