CVE-2026-105794
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, M
CVSS
—
No CVSS
EPSS
1.0%
p62
KEV
—
Exploit Today
19
0-100
Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-295
1.0%EPSS · 30 days1.0%
2026-10-072026-10-21
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
- github.comhttps://github.com/microsoft/msquic/commit/0591586443cc73a2d2cfb679527d91a144b4a412
- github.comhttps://github.com/microsoft/msquic/commit/508e811370df93e2ad848f5c78347d4fe4f65a91
- github.comhttps://github.com/microsoft/msquic/commit/90fd45498bf9b506b8556fb407088688474d6c81
- github.comhttps://github.com/microsoft/msquic/commit/a01333cf7c2659cce0ff03ef3f21e1ff15bb5b83
- github.comhttps://github.com/microsoft/msquic/pull/6274
- github.comhttps://github.com/microsoft/msquic/pull/6275
- github.comhttps://github.com/microsoft/msquic/pull/6276
- github.comhttps://github.com/microsoft/msquic/pull/6277
- github.comhttps://github.com/microsoft/msquic/releases/tag/v2.4.20
- github.comhttps://github.com/microsoft/msquic/releases/tag/v2.5.11
- github.comhttps://github.com/microsoft/msquic/releases/tag/v2.6.1
- github.comhttps://github.com/microsoft/msquic/security/advisories/GHSA-w5f4-fx9m-m4q7
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-106017——
———Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.17hCVE-2026-1142209.1 CRI—
———NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.17hCVE-2026-963754.8 MED—
———Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.17hCVE-2026-87944——
———Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.1dCVE-2026-1146428.7 HIG—
———Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.16hCVE-2026-1144066.8 MED—
———The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.
Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.17h