CVE-2022-26915
Published: 15 April 2022
Summary
CVE-2022-26915 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-26915 is a denial of service vulnerability in the Windows Secure Channel component, also known as Schannel. It received a CVSS 3.1 base score of 7.5 reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with the impact limited to high availability loss.
An unauthenticated remote attacker can send specially crafted network traffic to a vulnerable Windows system and trigger the flaw to disrupt the availability of the Secure Channel service, without gaining code execution or access to data.
Microsoft has published official guidance for the issue in its security update documentation, directing administrators to apply the relevant patches or mitigations listed for CVE-2022-26915.
The associated EPSS score reached a peak of 0.2089 and currently stands at 0.1761.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31461
Vulnerability details
Windows Secure Channel Denial of Service Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.