CVE-2016-7237: Windows LSASS crafted request denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (6.5) with availability-only impact, but high EPSS and a public exploit raise the practical risk for unpatched, legacy Windows hosts.

What it is

Microsoft Windows LSASS mishandles a crafted request, allowing a remote authenticated user to hang the system. The flaw is an access-control weakness (CWE-284) in a core authentication service, so a successful hit takes down a critical process and can render the host unresponsive. It affects a broad set of older Windows client and server releases listed in the record.

Impact

An attacker with valid credentials can cause a denial of service, hanging the affected system. There is no confidentiality or integrity impact per the CVSS vector; the effect is availability loss.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction, but it requires authenticated access (PR:L). The attacker must already hold valid credentials on the target or domain.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but a public Exploit-DB entry (40744) exists and EPSS is high at roughly 0.67 (99th percentile), indicating meaningful exploitation likelihood.

What to do

• Apply Microsoft security bulletin MS16-137 for the affected Windows versions as the primary fix.
• Restrict and monitor authenticated network access to LSASS-relevant services; limit who can send requests to the host.
• Segment or retire unsupported platforms such as Vista SP2, Server 2008 SP2/R2 SP1, and Windows 7 SP1 where feasible.
• Harden credential use and monitor for anomalous authenticated sessions that precede LSASS hangs.

Detection

• Alert on LSASS process crashes, hangs, or unexpected restarts in Windows event logs and crash dumps.
• Monitor for system unresponsiveness or service failures correlated with authenticated remote requests to the host.
• Watch for known public exploit traffic patterns against LSASS-related endpoints using network and host telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.