Windows Schannel does not properly verify cryptographic signatures, enabling an unauthorized attacker to spoof a trusted server in TLS communications over a network. This weakness can allow the attacker to impersonate any remote host that uses Schannel, potentially leading to man‑in‑the‑middle attacks or interception of sensitive data. The flaw is a type of improper verification of cryptographic signature (CWE‑347) and directly affects the confidentiality and integrity of encrypted network traffic.

Affected versions include Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1 (both x64 and arm64), as well as Windows Server 2022 and Windows Server 2025 (including Server Core). These systems run the registry of product identifiers listed in the CVE data and are the only versions explicitly mentioned as impacted at this time.

The CVSS score of 9 marks this as a high‑severity vulnerability, and the lack of an EPSS score means current exploitation probability data is unavailable. The vulnerability is not listed in CISA’s KEV catalog. Attackers can leverage the Schannel component over an arbitrary network connection, so the likely attack vector is remote network-based, inferred from the nature of Schannel spoofing. Remediation would require applying the vendor’s security update, and until then, the exposure remains significant for systems that rely on Schannel for TLS security.