Microsoft has assigned CVE-2026-20854 to a newly disclosed vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) that Microsoft and several security vendors classify as a critical remote code execution risk; the flaw was included in the January 2026 Patch Tuesday...
A newly disclosed and patched vulnerability—tracked as CVE-2026-20854—targets the Windows Local Security Authority Subsystem Service (LSASS) and is classified as a remote code execution (RCE) weakness that can be triggered over the network without elevated privileges. The issue was bundled into...