CVE-2026-119952 is a critical remote code execution flaw in Windows Schannel, Microsoft's system for handling encrypted connections. It was fixed in Microsoft's November 2026 Patch Tuesday security updates, released on Tuesday 10 November 2026. An unauthenticated attacker could exploit it by sending a specially crafted packet to an affected service over a network, with no password, no account and no click from the user required, and successful exploitation could allow the attacker to run their own code on the target computer. Microsoft rates exploitation as "more likely", but the flaw is not known to have been exploited and was not publicly disclosed before the patch was released.

The flaw carries a CVSS score of 8.1, which sits in the "high" band, while Microsoft's own severity rating for it is "critical". That difference confuses many readers, and it is explained below. The short version is that the two labels come from two different scoring systems. What matters for Windows users is simple: if you run a supported version of Windows and have not installed the November 2026 security updates, install them now and restart your computer.

What is Schannel?

Schannel, short for Secure Channel, is the part of Windows that implements TLS and SSL, the encryption protocols that keep communications private and authenticated. Whenever a Windows computer or server sets up an encrypted connection, for example to a website, a mail server or another service on a network, Schannel is often the component doing the cryptographic work behind the scenes. Microsoft describes it as the security support provider responsible for implementing TLS and SSL functionality in Windows.

That is why a flaw in Schannel matters more than a flaw in a single application. Schannel is used by many different Windows services, so a vulnerability in it can potentially be reached through more than one route. Rapid7's lead software engineer Adam Barnett, quoted by IT Brief, noted that because Schannel supports encrypted communications across numerous Windows services, the weakness "may widen the pool of exposed endpoints", although Microsoft's advisory notes that specific conditions are required for exploitation.

What does CVE-2026-119952 actually do?

The flaw is a remote code execution vulnerability, which means an attacker who exploits it can run code of their choosing on the victim's computer, rather than merely crashing it or reading data. Microsoft's advisory, as reported by Tenable and Rescana, says an unauthenticated attacker could send a specially crafted packet to an affected service over the network, and that successful exploitation would allow arbitrary code to be executed on the affected system. No authentication is needed, and no user interaction is needed: nobody has to open an attachment or click a link.

The underlying weakness is catalogued as CWE-208, an observable timing discrepancy. In plain terms, the flaw involves a difference in how long Schannel takes to respond in different situations, which an attacker can observe and use as part of an attack. The details of the timing behaviour are technical and have not been published in full, and no public exploit code is known to exist.

There is an important limit on the risk. Microsoft's CVSS scoring gives the flaw an attack complexity of "high", meaning that exploitation requires specific protocol conditions or settings to be in place, and that it is not a simple matter of sending one packet to any Windows computer. Rapid7's Barnett made the same point, saying Microsoft's advisory notes that specific conditions are required, but adding that Microsoft's assessment that exploitation is "more likely" suggests reliable exploit code may be achievable. He also said an attacker may not need an existing presence on the same network subnet to exploit the flaw in many circumstances.

The score explained: why 8.1 but "critical"?

Readers who look up CVE-2026-119952 will see two different severity labels, and both are correct. The CVSS 3.1 base score is 8.1, which falls in the "high" band (7.0 to 8.9), because the attack complexity is high. Separately, Microsoft's own severity rating for the flaw is "critical". The CVSS score is a standard, industry-wide measure; Microsoft's severity rating is the vendor's own judgement of how seriously its customers should treat the issue. Rescana, which analysed the Microsoft advisory, stressed that the "critical" label is Microsoft's severity field, not the CVSS band, and that the two should not be confused.

The practical point is that Microsoft considers this one of the most important flaws in the November release, even though its CVSS score is lower than the two 9.8-rated flaws fixed at the same time. Microsoft's exploitability assessment, "exploitation more likely", is what pushes it up the priority list: the company believes working exploit code is achievable, so unpatched systems should not be left exposed while attackers study the patch.

Which versions of Windows are affected?

The flaw affects a wide range of supported Windows versions. According to the Microsoft advisory, as summarised by Rescana, the affected versions are Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core editions where listed. The fixes are delivered through the November 2026 Windows security updates, including cumulative updates and hotpatches KB5131077, KB5131080, KB5131085, KB5131087, KB5131090, KB5131096, KB5131291, KB5132043, KB5132059 and KB5132061, with the exact update depending on the Windows version. A restart is required after installing the update.

For Windows 10 users in the Extended Security Updates programme or on Enterprise LTSC, the KB5131096 update brings systems to build 19045.7846 or 19044.7846 respectively, according to Archynetys' summary of the release. Home users on Windows 10 or Windows 11 will normally receive the fix through Windows Update, provided automatic updates are switched on.

Has CVE-2026-119952 been exploited?

No. Microsoft marks CVE-2026-119952 as not exploited and not publicly disclosed, and no security firm reporting on the release has claimed otherwise. The only vulnerability in the November 2026 release that Microsoft has identified as exploited is a different flaw, CVE-2026-124194, a spoofing vulnerability in classic Outlook. That flaw was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue on 10 November 2026, with a remediation due date of 24 November 2026 for US federal agencies.

That distinction matters. "Exploitation more likely" is a warning about the future, not a report of attacks happening now. It means Microsoft believes an attacker could develop a reliable exploit, so patching should not wait. It does not mean anyone has been hacked through this flaw.

What else was fixed in the November Patch Tuesday?

The November 2026 Patch Tuesday was one of Microsoft's largest releases. Tenable counted 1,093 CVEs fixed in the release, with 63 rated critical, 1,029 rated important and one rated moderate. Elevation of privilege flaws accounted for 48.9% of the fixes, followed by remote code execution flaws at 27.1%. Other firms counted the release slightly differently, with totals ranging from 1,091 to 1,092, because of differences in how they count related records.

Alongside the Schannel flaw, Microsoft fixed two other critical remote code execution vulnerabilities in Windows components. CVE-2026-116928 affects Windows Search and scores 9.8; it can be triggered by a crafted email attachment processed by Exchange for indexing. CVE-2026-119958 affects Windows LDAP and also scores 9.8; it can be exploited through crafted LDAP calls that run code in the LDAP service context. Microsoft rates exploitation of both as less likely than for the Schannel flaw, which is why the Schannel issue, despite its lower score, is high on the patching priority list.

How to check you are patched

For most home users, the fix arrives through Windows Update. Open Settings, go to Windows Update, and install any available updates, then restart the computer when prompted. The update that fixes CVE-2026-119952 is the November 2026 cumulative security update for your version of Windows, so if your computer shows that it is up to date with the November 2026 updates installed, the Schannel flaw is fixed.

Businesses and IT administrators should apply the November 2026 Windows security updates as a priority, starting with internet-facing servers and systems running services that use Schannel, and should also apply the Microsoft 365 Apps or Office LTSC security updates for the exploited Outlook flaw, CVE-2026-124194. Microsoft's Security Update Guide lists the exact update for each product and version. If an update fails to install, do not assume the system is protected: check the update history in Windows Update and retry the installation.

Frequently asked questions

Am I affected by CVE-2026-119952? If you run a supported version of Windows 10, Windows 11 or Windows Server and have not installed the November 2026 security updates, yes, your system is affected. Installing those updates fixes the flaw.

Has anyone been hacked through this flaw? Not as far as is known. Microsoft says the flaw has not been exploited and was not publicly disclosed before the patch. The exploited flaw in the same release is a separate Outlook issue, CVE-2026-124194.

Do I need to do anything if Windows Update is automatic? Automatic updates should install the fix, but you should still check that the November 2026 updates are installed and restart your computer, because the update only takes full effect after a restart.

What is Schannel? Schannel is Microsoft's implementation of TLS and SSL in Windows. It handles the encryption for secure connections used by many Windows services, which is why a flaw in it can affect a wide range of systems.

What is an observable timing discrepancy? It is a weakness, catalogued as CWE-208, in which a system takes measurably different amounts of time to respond in different situations, and an attacker can observe those timing differences and use them as part of an attack. Microsoft has not published the full technical details of how this applies to Schannel.

Why is the flaw rated critical if its CVSS score is only 8.1? The 8.1 is the industry-standard CVSS score, which sits in the high band because exploitation requires specific conditions. "Critical" is Microsoft's own severity rating, reflecting its judgement that the flaw, combined with its "exploitation more likely" assessment, should be treated as a top patching priority.

Sources: Tenable, Rescana, IT Brief, SecPod.