Windows 11 26H1: Remote code execution in Schannel
Summary
Windows 11 version 26H1 is affected by an out-of-bounds write vulnerability in Windows Schannel, the built-in SSL/TLS component. An unauthenticated attacker on the network can execute code on affected systems without user interaction. The attack complexity is high (AC:H), so exploitation requires specific conditions, and the risk is highest for hosts that terminate TLS for network services.
Affected
- Microsoft Windows 11 version 26H1 (x64 and ARM64)
- Builds 10.0.28000.0 up to, but not including, 10.0.28000.3231
Fixed in
- Build 10.0.28000.3231 or later, shipped with the October 13, 2026 update KB5127646 (per secondary sources; verify on the MSRC page)
Workaround
Unknown.
Exploitation
- Not listed in the CISA KEV catalog according to Strix (not directly verified).
- No public proof of concept found.
- EPSS about 0.007 (very low predicted likelihood).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- CVSS 3.1 base score 8.1 per NVD and CNA; VulDB records 10.0.
Our recommendation
- Identify Windows 11 26H1 systems in your asset inventory.
- Install the October 2026 update (build 10.0.28000.3231 or later) and prioritise internet-facing systems.
- Check the MSRC advisory and the CISA KEV catalog again in a few days, as the record was still under analysis.
- Monitor TLS-exposed services for unusual activity.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Schannel
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows
- Updates (KB)
- KB5127646
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105005 msrc.microsoft.com
- VulDB: CVE-2026-105005 vuldb.com
- Vulners: NVD record CVE-2026-105005 vulners.com
- Vulners: CVELIST record CVE-2026-105005 vulners.com
- Strix: CVE-2026-105005 www.strix.ai
- ThreatInt: CVE-2026-105005 cve.threatint.com
- HKCERT: Microsoft monthly security update October 2026 www.hkcert.org
- Qualys: Microsoft Patch Tuesday October 2026 blog.qualys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:41.
Original description (NVD)
Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.