---
id: "CVE-2026-119952"
page: "https://infrastack.ai/live/CVE-2026-119952"
kind: "vulnerability"
aliases: ["CVE-2026-119952"]
title: "Windows Schannel: timing discrepancy lets a network attacker run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Schannel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "schannel", "tls", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:18+00:00"
first_seen_at: "2026-11-10T19:25:04+00:00"
updated_at: "2026-11-10T22:16:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119952", "first_seen_at": "2026-11-10T19:25:04+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119952", "first_seen_at": "2026-11-10T22:16:48+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119952"]}]
exploit_sources: []
---

# Windows Schannel: timing discrepancy lets a network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-119952 (this .md is for agents)

Windows Schannel, the Microsoft TLS library used for encrypted connections, has an observable timing discrepancy that an unauthorized attacker can use over the network. According to the NVD entry, this allows the attacker to execute code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Schannel affected range not listed fixed no fixed version listed

## How to check

Open the MSRC Update Guide entry for CVE-2026-119952, find your Windows version/build in the Security Updates table, and compare it with the installed build (winver, or Get-HotFix for the KB listed). Affected builds and KB numbers: unknown, not read from the page.

## Timeline

- 2026-11-10T19:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119952
- 2026-11-10T22:16:48+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119952 — MSRC page is JS-only; only a secondary extraction of the Update Guide API (Critical, CVSS 8.1, AC:High, Exploitation More Likely, not publicly disclosed/not exploited) was obtained. No builds, KBs or config conditions read, so nothing is verified. web-cli get returned empty; x-cli not tried. Revisit with a browser-cli read of the guide.

## Documents

- [advisory] MSRC: CVE-2026-119952 Windows Schannel Remote Code Execution https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119952
- [mentions] Rapid7: Patch Tuesday - November 2026 https://www.rapid7.com/blog/post/patch-tuesday-november-2026-em
- [mentions] Rapid7: Patch Tuesday - November 2026 https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026

## From the sources

Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_