Windows Cryptographic Services CVE-2026-44806

Exploitation requires network reachability to a Windows host running an affected build whose exposed service invokes Windows Cryptographic Services (e.g., TLS/SChannel, certificate, or signing operations) on the network path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed against default configurations. The practical limiting factor is that impact is cumulative rather than instantaneous - a single request only leaks a small amount of memory, so an attacker must send many repeated requests (feasible because SSVC rates it Automatable) to drive resource exhaustion; impact is availability-only (A:H, C:N/I:N), so it grants no code execution, data disclosure, or bypass despite the misleading 'Authentication Bypass' tag.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity, unauthenticated flaw with high availability impact but no confidentiality or integrity loss - a pure DoS. Corroborating signals temper the urgency: EPSS is only 0.78% (52nd percentile), SSVC records Exploitation as 'none' and Technical Impact as 'partial', and no KEV listing or POC is present, so this is not confirmed to be actively exploited. However, SSVC marks Automatable as 'yes,' meaning the leak-triggering request can be scripted and repeated at scale, which raises practical concern for internet- or LAN-exposed services. One conflict must be flagged: the input Tags label this 'Authentication Bypass,' but the description, CWE-401, and the C:N/I:N/A:H vector all indicate a denial-of-service memory leak, not an auth bypass - treat the tag as a likely mislabel and rely on the DoS characterization. Net assessment: a legitimate but moderate-priority patch item - real remote DoS exposure, no confirmed exploitation, straightforward to remediate.

An attacker with network reach to an exposed Windows host repeatedly sends crafted requests to a service backed by Windows Cryptographic Services (for example a TLS/SChannel-negotiating endpoint), each request leaking memory that is never reclaimed. Sustained over time and scripted (SSVC Automatable: yes), the accumulating allocations exhaust memory and cause the cryptographic service and dependent functionality to fail. No authentication or user interaction is required, though no public exploit code is identified at time of analysis.