What the vulnerability allows
Microsoft’s official advisory states:
The weakness is classified as CWE-295, improper certificate validation. The advisory describes a security-feature bypass—not a remote code execution vulnerability—and identifies an authorized attacker as the threat actor.
Microsoft provides the following assessment:
| Advisory field | Value |
|---|---|
| Severity | Important |
| CVSS base score | 5.3 |
| CVSS temporal score | 4.6 |
| Weakness | CWE-295 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
What that score means for administrators
Reading the vector provides a more useful operational picture than the number alone:
- Network attack vector: The attack can occur over a network.
- High attack complexity: Exploitation is subject to conditions reflected in the high-complexity rating.
- Low privileges required: The assessed attack requires some existing privileges; it is not characterized as an unauthenticated attack.
- No user interaction: The vector does not require another user to participate.
- Unchanged scope: The assessed impact remains within the same security authority.
- High integrity impact: Integrity is the principal impact represented in the score; confidentiality and availability are rated as having no impact in this assessment.
These are interpretations of the supplied vector, not additional exploit findings. In particular, “Exploitation Less Likely” is a prioritization signal, not a substitute for installing the fix. Microsoft explicitly identifies customer action as required.
Affected products and exact remediation
Microsoft’s remediation mappings cover eight product entries. The instructions below preserve the specific update and fixed-build targets for each one.
Windows Server 2016
- For Windows Server 2016 (Server Core installation) (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows Server 2016 (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
Windows Server 2019
- For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
Windows Server 2022
- For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
- For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
Windows Server 2025
- For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
- For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
Practical implications for patch verification
Two comparisons in Microsoft’s mappings deserve attention.
First, Server Core and the corresponding non-Core product entry share the same update-to-build mappings within each server generation. Server Core is explicitly included in the affected-product list; its presence should not be treated as an exemption from this advisory.
Second, Windows Server 2025 has two supplied KB-to-build mappings, whereas each earlier listed generation has one. A verification checklist should preserve those individual pairings rather than reduce them to a generic “update installed” entry. The mapping itself should not be interpreted as an installation-order instruction.
For deployment tracking, a practical record should capture:
- The exact affected product, including whether it is a Server Core installation.
- The applicable KB, matched to that product.
- The corresponding fixed build, checked against the remediation mapping.
- The deployment result, so an assigned update is not mistaken for a completed remediation.
This checklist is an operational synthesis of the supplied advisory data, not an additional Microsoft requirement. Its value is straightforward: it makes patch verification specific enough to catch a mismatched server generation or an incorrectly recorded build.
Bottom line
CVE-2026-105590 is an Important certificate-validation vulnerability with a network attack path, an authorization requirement, and high attack complexity. Microsoft reports Exploitation Less Likely, while still requiring customer action.
The appropriate response is targeted patching and precise verification: identify the affected Windows Server product, apply its mapped update, and confirm the corresponding fixed build. For this advisory, Server Core belongs on the checklist—not outside it.