Windows Schannel CVE-2026-56186

Exploitation requires network access to a Windows service that uses Schannel for TLS/SSL and, per the CVSS vector's PR:L, an authenticated or otherwise authorized attacker - this is not remote-unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are the authentication/authorization requirement and the need for a reachable Schannel-backed endpoint; the impact is confined to information disclosure (C:H) per the description, with integrity unaffected (I:N). The A:H in the vector suggests a possible service crash from the over-read but the vendor description does not confirm an availability impact.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) indicates a network-reachable flaw of low complexity requiring some level of privilege (PR:L, i.e. authenticated), with high confidentiality impact. Note a discrepancy worth flagging: the vector lists A:H (high availability impact), yet the description characterizes this strictly as information disclosure with no integrity or availability effect claimed - the A:H is plausibly from an over-read that can also crash the service, but the vendor text does not confirm a DoS, so treat the availability rating as unverified. There is no EPSS score, no POC, and no KEV listing in the provided data, so real-world exploitation pressure currently appears low despite the high base score. The practical priority is elevated because Schannel is ubiquitous and network-facing, but the PR:L requirement (attacker must be authenticated) meaningfully narrows the threat versus a fully unauthenticated flaw.

An attacker who already holds valid credentials or an authenticated session to a Windows service that terminates TLS via Schannel sends crafted protocol data over the network, causing Schannel to over-read process memory and return leaked bytes (potentially session material or other secrets) in its response. Given AV:N and AC:L, the interaction is straightforward once authenticated, but no public exploit code has been identified at time of analysis.