Microsoft Windows Schannel: Spoofing vulnerability

Summary

A flaw in Windows Schannel, the built-in TLS/SSL library used by Windows services and applications for encrypted connections, allows an unauthenticated attacker to perform spoofing over the network. NVD rates it CRITICAL with CVSS 3.1 base score 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Exposure is highest for Schannel-based services reachable from the internet, such as RDP gateways, IIS, LDAPS or VPN and web front ends, while internal-only exposure is lower. The CNA description contains a stray 'No cwe for this issue' prefix, which appears to be a data-quality artefact.

Affected

• Microsoft Windows 10 Version 1607 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Microsoft Windows Server 2016 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (below 10.0.17763.9376)
• Microsoft Windows 10 Versions 21H2 and 22H2 (below 10.0.19044.7807 and 10.0.19045.7807)
• Microsoft Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see the MSRC advisory for exact builds)
• Microsoft Windows Server 2012 and 2012 R2, including Server Core (below 6.2.9200.26434 and 6.3.9600.23470)
• Note: the NVD CPE lists only Windows 10 1607; the CNA record lists the wider scope above.

Fixed in

• Windows 10 1607 and Server 2016: build 10.0.14393.9612 or later (Microsoft KB5126868, reported; not yet verified against the Microsoft Update Catalog)
• Other products: fixed builds as listed in the CNA record; confirm against the MSRC advisory
• Affected Windows 10, Windows 11 and Server 2012 builds listed above are the minimum fixed versions per the CNA record

Workaround

• Unknown. No workaround or mitigation was found in the sources reviewed. Patching is the only documented remedy.

Exploitation

• No evidence of exploitation in the wild and no public proof of concept found in the sources reviewed; this is not confirmed absence.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• The Zero Day Initiative classifies it as 'wormable' (unauthenticated network attack without user interaction). This is a classification, not evidence of exploitation.
• A broker-style exploit price estimate (USD 25k to 100k) exists; this is not evidence of exploitation.
• Check CISA KEV and MSRC exploitability flags for updates.

Our recommendation

• Inventory all Windows hosts and Server 2016 systems, including build numbers, and identify any on Windows 10 1607.
• Confirm the fixed build and KB against MSRC, then patch, prioritising internet-facing systems and end-of-life hosts.
• Restrict network access to Schannel-using services (RDP, IIS, LDAPS, VPN) to what is needed and limit internet exposure.
• Replace unsupported 1607 systems where patching is not possible.
• Monitor CISA KEV and MSRC for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide msrc.microsoft.com
• Vulners NVD record vulners.com
• Vulners VulnRichment vulners.com
• VulDB entry (CWE/CVSS conflict) vuldb.com
• KB listing (EUVD-2026-100397) vulners.com
• Zero Day Initiative October 2026 review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:12.