Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105794— MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

Quick assessment

Affected
microsoft msquic
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MsQuic 是一个跨平台的 C 语言实现，提供了对 IETF QUIC 协议的支持，并暴露给 C、C++、C和 Rust 编程语言。在版本 2.4.20、2.5.11 和 2.6.1 之前，使用 OpenSSL 或 QuicTLS TLS 后端的 MsQuic 客户端未能正确验证服务器证书是否与预期的目标服务器主机名匹配。因此，中间人攻击者可以展示一个不匹配预期目标主机名的证书，从而在中间人攻击中伪造服务器身份。Schannel 后端不受此问题影响。该问题已在版本 2.4.20、2.5.11 和 2.6.1 中修

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105794

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Source: CVE Program / CVE List V5
Vulnerability Description
MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
microsoft msquic < 2.4.20 -

II. Public POCs for CVE-2026-105794

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105794

请登录查看更多情报信息。

Other References for CVE-2026-105794 (12)

Same Patch Batch · microsoft · 2026-10-06 · 11 CVEs total

CVE-2026-105793 9.1 CRITICAL Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
CVE-2026-105797 8.8 HIGH SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spaw
CVE-2026-105796 8.8 HIGH Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP gene
CVE-2026-105788 8.8 HIGH Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and l
CVE-2026-105798 8.7 HIGH SimpleChat: Stored XSS via group document filename in inline onclick handler
CVE-2026-105791 7.5 HIGH Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injecti
CVE-2026-105792 6.5 MEDIUM Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
CVE-2026-105790 6.4 MEDIUM Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinni
CVE-2026-105789 5.4 MEDIUM Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
CVE-2026-105795 3.1 LOW Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

IV. Related Vulnerabilities

Same vendor: microsoft
Same weakness: CWE-295

V. Comments for CVE-2026-105794

No comments yet

Leave a comment