Microsoft has fixed a critical remote code execution flaw in Windows Schannel, the component that handles encrypted connections for Windows services. Tracked as CVE-2026-119952, the vulnerability was patched as part of Microsoft's November 2026 security updates, released on 10 November.

Schannel is Microsoft's implementation of the Transport Layer Security (TLS) protocol, which secures connections for a wide range of Windows services, from web servers to remote desktop and email. A flaw in Schannel is therefore a concern for administrators, because the vulnerable code sits behind services that are often reachable over a network and, in some cases, from the internet.

How the flaw works

The vulnerability stems from an observable timing discrepancy, tracked as CWE-208, in the way Schannel handles certain input. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and, if the attack succeeds, execute code on the target system. No login and no action by the user are required, which is why Microsoft describes it as a pre-authentication flaw.

Microsoft rates the flaw Critical, its highest severity label, with a CVSS version 3.1 score of 8.1. The score is held down by high attack complexity: Microsoft says specific conditions, such as particular protocol settings or configurations, must be in place for the attack to work. Even so, Microsoft assesses exploitation as more likely, meaning it expects reliable exploit code to be achievable. Security researchers at Rapid7, who highlighted the flaw in their review of the release, noted that in many cases an attacker would not need a foothold on the same network, and that code could run with high privileges depending on the affected service, possibly as SYSTEM.

Which systems are affected

The flaw affects a broad set of supported Windows versions: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. The fix is delivered through the November 2026 Windows security updates, so installing those updates closes the flaw.

Part of a very large Patch Tuesday

CVE-2026-119952 was one of 1,092 vulnerabilities Microsoft fixed in its November release, according to Rapid7's count, the second month in a row above 1,000. Of those, the only flaw Microsoft confirmed as actively exploited was a separate Outlook spoofing vulnerability, CVE-2026-124194. The Schannel flaw was not publicly disclosed before the fix, no public proof-of-concept code is known, and it has not been reported as exploited. That may change now that the patch is public, so the usual advice applies: prioritise the November Windows updates on internet-facing and business-critical servers first, then roll them out across the estate. Organisations should also review which services expose Schannel to the network and make sure only the services they need are reachable.

Sources: IT Brief, Action1