CVE-2026-105794: Microsoft Msquic

Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days.

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can therefore present a certificate that does not match the intended target hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected. This issue is fixed in versions 2.4.20, 2.5.11, and 2.6.1.

Affected products

• Microsoft Msquic: before 2.4.20 (fixed in 2.4.20); from 2.5.0, before 2.5.11 (fixed in 2.5.11); from 2.6.0, before 2.6.1 (fixed in 2.6.1)

Published 2026-10-06. Last modified 2026-10-06.