Windows Schannel EUVD-2026-100397

Exploitation requires the attacker to occupy a privileged position on the network path between client and server to interfere with a Schannel-negotiated TLS session (consistent with AV:N combined with AC:H and the 'spoofing over a network' description); it does not require authentication (PR:N) or user interaction (UI:N). The practical limiting factor is achieving that man-in-the-middle or on-path position and satisfying the specific handshake/timing conditions implied by AC:H, which prevents straightforward opportunistic exploitation against arbitrary remote targets. Exact affected Windows versions and whether any non-default TLS/cipher configuration is required are not specified in the available data and should be confirmed in the MSRC advisory.

Microsoft rates this Windows Schannel spoofing flaw at CVSS 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning network-reachable and unauthenticated (PR:N) but with high attack complexity (AC:H) and a scope change (S:C) propagating full confidentiality, integrity, and availability impact beyond the vulnerable component. The high score is driven almost entirely by the triple-High impact plus scope change rather than by ease of exploitation - AC:H signals a meaningful precondition such as a privileged network position, a race, or specific handshake timing, which tempers the real-world likelihood versus a trivially remote bug. No EPSS score, CISA KEV listing, or public POC was provided, so there is no current evidence of active or imminent exploitation; the risk at this moment is latent rather than demonstrated. Two signals warrant caution and verification: the CWE is 'N/A' (no weakness classification), and a conflict exists in the metadata - the impact subscores (C:H/I:H/A:H) are unusually broad for a vulnerability labeled strictly as 'spoofing,' which typically maps to integrity impact; confirm the exact impact profile against the Microsoft advisory. Given Schannel's role as the core Windows TLS/SSL provider, a confirmed exploitable spoofing/MITM primitive here would be a genuine priority, but the AC:H gate and absence of exploitation signals place it below trivially-exploitable, actively-exploited bugs in patching order.

An attacker positioned on the network path (e.g., via ARP/DNS poisoning or a rogue access point) interferes with a Schannel-protected TLS session and exploits the flaw to spoof a trusted server identity or manipulate the handshake, causing the victim client to establish a session it believes is authentic. This enables interception or tampering of ostensibly secure traffic. No public exploit is identified, and the AC:H rating indicates the attacker must achieve a privileged network position and meet specific handshake conditions to succeed.