Windows Remote Desktop Services: Information disclosure over the network
Summary
Microsoft has fixed an information disclosure vulnerability in Windows Remote Desktop Services (CWE-497, exposure of sensitive system information to an unauthorized control sphere). An attacker with valid low-privilege credentials and network access to an RDS host could read sensitive system information. The attack complexity is high, and the impact is limited to confidentiality.
Affected
- Windows 10 Version 1607, 1809, 21H2 and 22H2
- Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2
- Windows Server 2016 (including Server Core), 2019 (including Server Core) and 2022
- Affected builds according to the CVE record; Server 2012 and 2012 R2 status is unknown.
Fixed in
- Windows 10 1607: 10.0.14393.9688
- Windows 10 1809: 10.0.17763.9487
- Windows 10 21H2: 10.0.19044.7846
- Windows 10 22H2: 10.0.19045.7846
- Windows 11 23H2: 10.0.22631.7711
- Windows 11 24H2: 10.0.26100.9974
- Windows Server 2016: 10.0.14393.9688
- Windows Server 2019: 10.0.17763.9487
- Windows Server 2022: 10.0.20348.5870
- Confirm the exact builds and cumulative update numbers on the MSRC update guide before rollout.
Workaround
Unknown. No Microsoft workaround has been identified. Apply the security update.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Rapid7 rates exploitation as less likely.
- No public proof of concept for this CVE found; unverified.
Our recommendation
- Install the November 2026 cumulative update on all affected RDS hosts and session hosts, starting with internet-facing or heavily used RDS servers.
- Do not expose RDS directly to the internet; use a VPN or gateway with MFA.
- Review and remove unused accounts with remote access rights.
- Check your customers' inventories for RDS roles and monitor for unusual logons.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows Remote Desktop Services
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-119882 msrc.microsoft.com
- CVE Record CVE-2026-119882 www.cve.org
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Strix: CVE-2026-119882 www.strix.ai
- Senserva: KB5131087 senserva.com
- Action1: Patch Tuesday November 2026 www.action1.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:31.
Original description (NVD)
Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.