CVE-2026-96858: Windows Security Account Manager Tampering Vulnerability
Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
Other sources
Windows Security Account Manager Tampering Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33650Patch KB5126646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5761Patch KB5126655 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker must already be authorized on the affected system and able to act locally. No user interaction is required.
What is the expected impact of successful exploitation?
Successful exploitation enables tampering with a critical function in Windows Security Account Manager. The stated impact is limited to integrity; no confidentiality or availability impact is indicated.
Can this be exploited remotely or across a security boundary?
The attack vector is local, so the provided data does not indicate remote exploitation. The scope is unchanged, indicating the impact remains within the same security authority.