EUVD-2026-43848
GHSA-h8h9-72c6-9q22
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H assigned because certificate bypass exploitation requires MITM positioning or inducing a specific certificate exchange, consistent with SSVC 'Automatable: no'; all other metrics align with the provided vector.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Technical ContextAI
Windows Cryptographic Services encompasses the Windows Certificate Store, CryptoAPI (CAPI2), and Cryptography Next Generation (CNG) subsystems responsible for PKI operations including certificate chain building, revocation checking, and trust anchor validation. CWE-295 (Improper Certificate Validation) identifies the root cause class: the affected code path fails to correctly verify one or more properties of a presented certificate - such as signature validity, chain completeness, revocation status, or name constraints - allowing a malformed or unauthorized certificate to be accepted as trusted. CPE data confirms the flaw is present across eight distinct Windows product lines from 10.0.19044 through 10.0.28000 build families, indicating the defective validation logic exists in a shared cryptographic component present in both client and server SKUs.
RemediationAI
Apply Microsoft's released cumulative updates that advance each affected build to or beyond the fixed thresholds: Windows 10 21H2/22H2 to build 10.0.19044.7548 or 10.0.19045.7548 respectively, Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 (full and Server Core) to 10.0.26100.33158. Patches are available via Windows Update, WSUS, and Microsoft Update Catalog; the authoritative advisory with direct download links is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50302. If immediate patching is not feasible, compensating controls include restricting outbound connections from affected hosts to only known-good, internally controlled TLS endpoints (reducing MITM exposure), enforcing certificate pinning in applications where supported, and enabling Enhanced Certificate Validation Group Policy settings where available. Note that certificate pinning may break legitimate connections to services that rotate certificates frequently.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today