Microsoft Windows LSASS: Use after free allows local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Local Security Authority Subsystem Service (LSASS) allows privilege escalation on affected Windows 10, Windows 11 and Windows Server systems. An attacker needs local access and low privileges, for example through a compromised user account, and the attack is rated as highly complex. Successful exploitation could give the attacker full control of the host, including access to credentials stored by LSASS, which enables further movement in the network.

Affected

• Windows 10 Version 1607, 1809, 21H2 and 22H2
• Windows 11 Version 23H2, 24H2, 25H2 and 26H2, and Version 26H1
• Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
• Exact affected build ranges: see the CVE record and the MSRC Security Update Guide

Fixed in

• Install the Microsoft security update published on the release date of CVE-2026-70231 (November 2026 Patch Tuesday) for your Windows version.
• Fixed builds per the CVE record: 10.0.14393.9688 (Windows 10 1607 / Server 2016), 10.0.17763.9487 (1809 / Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (Windows 11 23H2), 10.0.26100.9974 (24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.20348.5870 (Server 2022).
• Unknown: the complete list of KB numbers per build; verify them in the MSRC Security Update Guide.

Workaround

Unknown. No vendor workaround was identified; apply the security update.

Exploitation

• Not known to be exploited in the wild, according to the advisory data available at the time of research (lower confidence).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Exploit code maturity is rated Unproven (E:U in the CVSS vector).
• No public proof of concept found at the time of research.

Our recommendation

• Patch affected Windows systems in the November 2026 update cycle, prioritising shared workstations, terminal servers and servers where many users have local logon.
• Check whether Windows 10 1607, 1809, 21H2 and Windows Server 2016 systems are still supported or covered by extended security updates, since this determines whether a fix is available.
• Limit local administrator rights and restrict local logon on servers and jump hosts.
• Keep endpoint protection and logging active and monitor for signs of privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70231 msrc.microsoft.com
• CVE Program record CVE-2026-70231 www.cve.org
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:15.