Advisory · CVE-2026-85818
Schannel signature verification flaw can undermine Windows TLS trust
Windows Schannel improperly verifies cryptographic signatures, a flaw Microsoft scores 9.0 with changed scope that an unauthenticated attacker can use over a network. Microsoft rates it CVSS 3.1 9.0.
- Vendor
- Microsoft
- Product
- Windows Schannel
- Identifier / CWE
- CVE-2026-85818
CWE-347 - Action timing
- Immediate
Explain it like I’m five
The component that checks whether a secure connection is really who it claims to be can be fooled about the signature it is checking.
- 01Reach the component
An unauthenticated attacker sends crafted network traffic to a Windows system running Windows Schannel.
- 02Memory flaw triggers
The component mishandles the input and corrupts or reuses memory outside its intended bounds.
- 03Code runs
The attacker gains code execution in the component's context on the target system.
What happened
Microsoft disclosed CVE-2026-85818 in its October 2026 update guide: improper verification of a cryptographic signature (CWE-347) in Windows Schannel. Exploitation requires high attack complexity per Microsoft’s vector, but the impact spans confidentiality, integrity, and availability with changed scope.
Microsoft lists the affected Windows releases in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Schannel deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Schannel while remediation is underway, especially for internet-facing instances.
- Review application and server logs for TLS handshake anomalies, certificate warnings users dismissed, and connections to lookalike services.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
A flaw in the trust checker itself is worse than a flaw in one application. Patch Schannel with the critical set and investigate any odd TLS warnings from the window before patching.