Its handshake sends certificates in the clear, negotiates key exchange through the cipher suite name and, in its static-RSA mode, provides no forward secrecy. Safe configuration means ECDHE (or DHE) with AEAD suites, the extended master secret (RFC 7627), renegotiation_info and SHA-256 or better signatures, as RFC 9325 recommends. RFC 9846 (July 2026) obsoletes RFC 5246 and sets new requirements for TLS 1.2 implementations.
Attacks over its lifetime targeted optional or legacy features: BEAST and Lucky Thirteen (CBC), RC4 biases, triple handshake (fixed by extended master secret), Logjam and FREAK (export-grade keys), ROBOT (RSA key transport) and SWEET32 (64-bit block ciphers). None break a TLS 1.2 connection limited to ECDHE and AEAD.
Keep TLS 1.2 enabled for older clients if you must, alongside 1.3; post-quantum hybrid key exchange exists only in TLS 1.3, so connections that fall back to 1.2 stay classical.