Microsoft Remote Desktop Client: Tampering vulnerability due to missing authentication

Summary

A missing authentication check for a critical function in the Remote Desktop Client allows an unauthorized remote attacker to tamper with data over the network. According to the CVSS vector, the attack requires low complexity, no privileges and user interaction, such as connecting to a malicious RDP server. The vendor advisory has not yet been reviewed, so the exact impact and conditions are unverified.

Affected

• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9974
• Windows Server 2019 (including Server Core): 10.0.17763.0 to < 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to < 10.0.20348.5870
• Windows Server 2025 (including Server Core): 10.0.26100.0 to < 10.0.26100.33822

Fixed in

• Fixed builds are the first versions at or above the upper limits listed under affected, per the CVE record.
• KB numbers: Unknown.

Workaround

Unknown.

• Until the advisory is reviewed, limit RDP client connections to trusted hosts and avoid connecting to unknown RDP servers.

Exploitation

• No in-the-wild exploitation known at the time of writing.
• No public proof of concept known.
• Not listed in CISA KEV as far as known.

Our recommendation

• Install the Microsoft security update for the affected Windows versions as soon as it is available, starting with workstations that use the RDP client.
• Until then, restrict RDP connections to trusted hosts and instruct users not to open unknown .rdp files.
• Check the MSRC advisory for the official CVSS vector, KB numbers and exploitability rating, and monitor CISA KEV.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119824 msrc.microsoft.com
• Microsoft Learn: Remote Desktop client release history learn.microsoft.com
• CWE-306: Missing Authentication for Critical Function www.immunitysec.com
• Zero Day Initiative: June 2026 security update review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:28.