Windows Schannel CVE-2026-70566

Requires the attacker to already have authenticated low-privileged local code execution on the Windows host (CVSS AV:L, PR:L); the flaw is in the Schannel (SSL/TLS) security provider, which is present by default in all supported Windows versions, so no special feature toggle appears necessary. There is no user-interaction requirement (UI:N) and attack complexity is low (AC:L). The principal limiting factors are the local-only attack vector - it cannot be triggered remotely over the network - and the prerequisite of an existing local foothold, which confines realistic exploitation to multi-user, shared, terminal-services, or server environments where untrusted parties can run code. Affected builds span Windows 10/11 (through 26H2), and Windows Server 2012 through 2025, below the fixed build numbers listed in the EUVD data.

This is a genuine patch-priority item but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) describes a local elevation-of-privilege flaw: the attacker must already be able to run code on the host with at least low privileges (PR:L), there is no network reachability (AV:L), and attack complexity is low. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is not confirmed or probable at this time - consistent with a fresh Microsoft-reported bug with a patch already available. There is a notable internal conflict in the data: the CWE (CWE-476, NULL pointer dereference) and the input Tags ('Denial Of Service', 'Null Pointer Dereference') point to a crash/DoS primitive, yet the CVSS impact metrics are C:H/I:H/A:H and the description states privilege elevation - verify with Microsoft whether the NULL deref is leveraged into full code execution/EoP or whether the high CIA impact reflects worst-case SYSTEM compromise. Net: treat as a standard high-severity local EoP to be remediated in the normal monthly cycle, prioritized on multi-user/shared and server hosts where untrusted local access exists; it is not a high-CVSS-but-trivial issue, but the local-only vector and required prior access meaningfully cap real-world risk versus a remote unauthenticated flaw.

An attacker who has already obtained low-privileged local access to a Windows host (for example via a compromised standard user account or a foothold from another exploit) invokes a crafted request against the Schannel component to trigger the NULL pointer dereference and corrupt execution state, elevating to SYSTEM. Exploitation requires no user interaction but does require prior local code execution (AV:L/PR:L/AC:L). No public exploit code was identified at the time of analysis.