Microsoft Windows LSASS: Remote code execution vulnerability

Summary

A out-of-bounds write in the Windows Local Security Authority Subsystem Service (LSASS) allows an attacker to execute code remotely on affected Windows systems. Many Windows 10, Windows 11 and Windows Server versions are affected, including Windows 10 1607 and Windows Server 2016. According to the CVSS vector, the attacker needs a valid low-privileged account and no user interaction, while the NVD description speaks of an unauthorized attacker, so the actual preconditions still need to be confirmed by Microsoft.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2, including Server Core (builds before 6.2.9200.26434 and 6.3.9600.23470)
• Windows Server 2016 (builds before 10.0.14393.9612)

Fixed in

• Install the October 2026 security update from Microsoft for the respective Windows version.
• Fixed builds per the CVE record: 10.0.14393.9612 (1607, Server 2016), 10.0.17763.9376 (1809), 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012), 6.3.9600.23470 (Server 2012 R2).
• Build numbers are not yet fully verified against the MSRC version table; check the exact build there.

Workaround

Unknown.

Exploitation

• MSRC rates exploitation as unlikely (Exploitation Unlikely, E:U).
• CISA SSVC: exploitation none, not automatable.
• No public proof of concept found; this does not prove that none exists.
• Not in the CISA KEV catalog.
• No known exploitation in the wild.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems and identify the exact builds.
• Apply the October 2026 cumulative update on priority, starting with internet-reachable or critical systems.
• Plan the replacement of Windows 10 1607 and Windows Server 2012, 2012 R2 and 2016 systems, as these may receive no further patches.
• Restrict network access to affected hosts where patching is not immediately possible.
• Monitor the MSRC FAQ and CISA KEV for updates on preconditions and exploitation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83928 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-83928 vulners.com
• OpenCVE: CVE-2026-83928 app.opencve.io
• Microsoft Security Bulletin coverage for October 2026 (SonicWall) www.sonicwall.com
• Strix.ai: CVE-2026-83928 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:24.