CVE-2026-85818
9.0CriticalPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-347
Impact
Remote, unauthenticated attackers can spoof identities over the network to compromise confidentiality and integrity across trust boundaries. They require network access to TLS/SSL endpoints handled by Schannel and a scenario allowing cryptographic signature bypass.
Root cause
Windows Schannel improperly validates cryptographic signatures during TLS handshakes.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for your Windows version immediately once released. If patching must wait, restrict network access to affected TLS endpoints using firewall rules or place them behind a terminating reverse proxy running a non-Windows TLS stack.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.