Microsoft Windows Schannel: Spoofing via improper signature verification
Summary
Windows Schannel, the TLS/SSL component of Windows, does not properly verify cryptographic signatures. A remote, unauthenticated attacker can exploit this over the network to spoof a trusted peer. The attack complexity is high, and no user interaction or privileges are required. Microsoft rates the flaw as Important and reports no public disclosure or known exploitation.
Affected
- Windows 11 23H2: earlier than 10.0.22631.7652
- Windows 11 24H2: earlier than 10.0.26100.9711
- Windows 11 25H2: earlier than 10.0.26200.9711
- Windows 11 26H1: earlier than 10.0.28000.3231
- Windows 11 26H2: earlier than 10.0.26300.9711
- Windows Server 2022: earlier than 10.0.20348.5761
- Windows Server 2025 (including Server Core): earlier than 10.0.26100.33650
Fixed in
- Microsoft security update of October 13, 2026 for each affected build. Unknown: KB numbers for Windows 11 and Windows Server 2022 (verify on the MSRC page).
- Windows Server 2025: KB5126646 (named by an aggregator, verify on MSRC).
Workaround
- No vendor workaround known.
- Unknown whether strict Schannel signature validation settings provide any mitigation.
Exploitation
- Publicly disclosed: No, according to Microsoft.
- Exploit maturity: Unproven (E:U).
- CISA SSVC: exploitation none, automatable no. Not in the KEV catalog.
- No public proof of concept found.
- Known exploited in the wild: Unknown.
Our recommendation
- Install the October 2026 security update on all affected Windows 11 and Windows Server systems, prioritising internet-facing servers.
- If patching is delayed, restrict exposure of Schannel-based services (RDP, IIS, RD Gateway, VPN/TLS endpoints) at the perimeter.
- Inventory which systems run the affected builds and monitor for exploitation indicators.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-85818 msrc.microsoft.com
- NVD record via Vulners vulners.com
- OpenCVE: CVE-2026-85818 app.opencve.io
- VulDB: CVE-2026-85818 vuldb.com
- Microsoft advisory via Vulners (MS) vulners.com
- Strix AI: CVE-2026-85818 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:11.
Original description (NVD)
Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.