What is the CVSS score of EUVD-2026-43789?

EUVD-2026-43789 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Windows Cryptographic Services are affected by EUVD-2026-43789?

A memory-leak vulnerability in Windows Cryptographic Services affects multiple Windows and Server platforms (10, 11, 2012-2025), enabling remote denial-of-service attacks without authentication.. A patch is available.

How to fix or mitigate EUVD-2026-43789?

Within 24 hours, inventory all Windows 10 (1607 through current), Windows 11 (all versions through 26H1), and Windows Server 2012 through 2025 systems in your environment. Within 7 days, deploy the available Microsoft patch to all identified systems, prioritizing servers and endpoints handling critical authentication or cryptographic operations. By day 30, verify patch deployment completeness across the enterprise and confirm systems are running patched versions, with priority given to any systems that handle security-sensitive workloads.

Windows Cryptographic Services EUVD-2026-43789

| CVE-2026-44806 HIGH

Memory Leak (CWE-401)

2026-07-14 microsoft

GHSA-rc9c-xm7h-wmcx

Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.5

CVSS 3.1 · NVD

Temporal: 4.6

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CIRCL (temporal)

4.6 MEDIUM

cvss

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity memory-leak DoS with high availability impact and no confidentiality or integrity effect, matching AV:N/PR:N and C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 16, 2026 - 17:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 16, 2026 - 17:37 vuln.today

cvss_changed

Severity Changed

Jul 16, 2026 - 17:37 NVD

MEDIUM HIGH

CVSS changed

Jul 16, 2026 - 17:37 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jul 14, 2026 - 21:57 vuln.today

CVE Published

Jul 14, 2026 - 17:05 cve.org

MEDIUM 5.3

DescriptionNVD

Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Windows Cryptographic Services affects a broad sweep of supported Microsoft platforms, from Windows 10 (1607) and Server 2012 through Windows 11 26H1 and Server 2025. A memory-leak flaw (CWE-401) lets a remote, unauthenticated attacker send network traffic that fails to release memory over time, degrading or exhausting the affected service until availability is impacted. There is no public exploit identified at time of analysis, exploitation is not yet observed (SSVC: none), and EPSS is low (0.78%), but a vendor patch is available and Automatable is 'yes', warranting prompt patching.

Technical ContextAI

Windows Cryptographic Services (the CryptSvc/CNG subsystem) provides certificate validation, key storage, signing, and cryptographic primitives consumed by TLS/SChannel, authentication, code-signing, and countless OS components. The root cause is CWE-401, 'Missing Release of Memory after Effective Lifetime' - a memory leak in which each handled request or session allocates memory that is never freed. Repeated over a network-facing code path, leaked allocations accumulate until the process or system runs low on memory, causing the cryptographic service (and dependent functionality) to fail. The CPE set confirms the affected component ships across the full range of client (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2012, 2012 R2, 2016, 2019, 2022, 2025), including Server Core installations.

RemediationAI

Vendor-released patch: apply the Microsoft security update for CVE-2026-44806, upgrading each affected system to at least its fixed build - for example Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2/25H2 to 10.0.26100.8875/10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Server 2022 to 10.0.20348.5386, Server 2025 to 10.0.26100.33158, Server 2019 to 10.0.17763.9020, Server 2016 to 10.0.14393.9339, Server 2012 R2 to 6.3.9600.23291, and Server 2012 to 6.2.9200.26226. Obtain the exact KB via the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44806. Because Cryptographic Services underpins TLS, certificate, and authentication functions, it cannot simply be disabled; where immediate patching is not possible, reduce exposure by restricting network access to affected hosts (host firewall/segmentation limiting which sources can reach cryptographic-dependent listeners such as SChannel/TLS endpoints), rate-limiting or fronting exposed services with a reverse proxy or load balancer to blunt repeated leak-triggering requests, and monitoring service memory with scheduled restarts of the affected service as a stop-gap - noting these controls only slow resource exhaustion and may interrupt legitimate cryptographic operations, so patching remains the only complete fix.