High · 7.5 CVE-2026-20854 EUVD-2026-2173GHSA-7g73-j999-7mq6

Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

Published Jan 13, 2026 · Updated Jul 30, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.7623	10.0.26100.7623
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.7623	10.0.26200.7623
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230

Advisories 3

NCSC-2026-0007 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Apr 10, 2026
WID-SEC-2026-0083 Microsoft Windows : Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2026
MSRC-CVE-2026-20854 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability Microsoft Security Response Center · Jan 13, 2026

References

Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability vendor-advisory patch