EUVD-2026-43848
GHSA-h8h9-72c6-9q22
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H assigned because certificate bypass exploitation requires MITM positioning or inducing a specific certificate exchange, consistent with SSVC 'Automatable: no'; all other metrics align with the provided vector.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Windows Cryptographic Services improperly validates certificates across multiple Windows 10, 11, and Server editions, enabling remote unauthenticated attackers to bypass security features enforced by the PKI/certificate trust chain over a network path. Affected platforms span Windows 10 21H2 and 22H2, Windows 11 24H2 through 26H1, and Windows Server 2022 and 2025 in both full and Server Core deployments. No public exploit identified at time of analysis; EPSS at 0.24% (15th percentile) and SSVC exploitation status of 'none' together indicate low near-term exploitation probability despite the broad product footprint.
Technical ContextAI
Windows Cryptographic Services encompasses the Windows Certificate Store, CryptoAPI (CAPI2), and Cryptography Next Generation (CNG) subsystems responsible for PKI operations including certificate chain building, revocation checking, and trust anchor validation. CWE-295 (Improper Certificate Validation) identifies the root cause class: the affected code path fails to correctly verify one or more properties of a presented certificate - such as signature validity, chain completeness, revocation status, or name constraints - allowing a malformed or unauthorized certificate to be accepted as trusted. CPE data confirms the flaw is present across eight distinct Windows product lines from 10.0.19044 through 10.0.28000 build families, indicating the defective validation logic exists in a shared cryptographic component present in both client and server SKUs.
RemediationAI
Apply Microsoft's released cumulative updates that advance each affected build to or beyond the fixed thresholds: Windows 10 21H2/22H2 to build 10.0.19044.7548 or 10.0.19045.7548 respectively, Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 (full and Server Core) to 10.0.26100.33158. Patches are available via Windows Update, WSUS, and Microsoft Update Catalog; the authoritative advisory with direct download links is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50302. If immediate patching is not feasible, compensating controls include restricting outbound connections from affected hosts to only known-good, internally controlled TLS endpoints (reducing MITM exposure), enforcing certificate pinning in applications where supported, and enabling Enhanced Certificate Validation Group Policy settings where available. Note that certificate pinning may break legitimate connections to services that rotate certificates frequently.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today