Windows Schannel vulnerability CVE-2026-105008 rated CVSS 9.0 allows unauthorized network spoofing attacks
A critical flaw in Windows Schannel allows unauthorized attackers to perform spoofing over a network, carrying a maximum severity score.
Key points
- CVE-2026-105008 carries a CVSS 9.0 rating classified as critical.
- The vulnerability affects the Windows Schannel component.
- Attackers can perform network spoofing without authorization.
Microsoft has published a security advisory for CVE-2026-105008, a vulnerability within the Windows Schannel component that allows an unauthorized attacker to perform spoofing over a network. The National Vulnerability Database records the issue with a CVSS 9.0 score, categorizing it as critical severity.
The flaw allows an unauthorized attacker to perform spoofing over a network. According to the official advisory, no Common Weakness Enumeration (CWE) identifier has been assigned to this specific issue. The description states that the problem in Windows Schannel permits an unauthorized attacker to perform spoofing over a network.
Technical details and severity
The National Vulnerability Database entry for CVE-2026-105008 confirms the high severity rating. A CVSS 9.0 score places this vulnerability in the critical range. The advisory text from Microsoft’s Security Update Guide reiterates that the issue resides within the Schannel subsystem.
There is no detailed technical breakdown of the specific mechanism behind the spoofing in the current public records. The source material simply notes that the issue allows an unauthorized attacker to perform spoofing over a network. The absence of a CWE code means the underlying weakness type is not formally categorized in the advisory text provided.
Affected systems
The vulnerability specifically impacts Windows systems utilizing the Schannel component. Schannel is a security support provider interface that provides cryptographic services for Windows. The NVD record lists the affected configuration as Windows Schannel, but does not specify particular versions or editions in the provided excerpt.
Organizations relying on Windows networking features should note that this flaw allows an unauthorized attacker to perform spoofing over a network. The advisory does not limit the impact to specific server or desktop versions, implying a broad scope within the Schannel implementation. Users should verify their specific environment against the full vendor guidance once available.
What should you do?
Security teams should monitor for further details from Microsoft regarding mitigation steps. Since no fix has been confirmed yet in the source material, administrators should review network logs for unusual activity. Organizations should ensure their incident response plans account for potential spoofing scenarios.
What to do and how to stay safe: Microsoft
- Audit network traffic for anomalies that might indicate spoofing attempts.
- Restrict unnecessary network exposure for systems running Windows Schannel.
- Monitor vendor channels for official patches or mitigation guidance.
- Review access controls to limit the impact of potential spoofing events.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-105008?
It is a critical vulnerability in Windows Schannel that allows an unauthorized attacker to perform spoofing over a network.
How severe is this vulnerability?
It has a CVSS 9.0 rating, which is classified as critical.
Is there a fix available?
The source material does not mention a confirmed patch or fix yet.
