Windows Remote Desktop: Security feature bypass via broken cryptographic algorithm

Summary

A broken or risky cryptographic algorithm in Windows Remote Desktop (RDP) allows an unauthorized attacker to bypass a security feature over the network. The attack complexity is high and user interaction is required, but no privileges are needed. A successful attacker could affect confidentiality and integrity, while availability is not affected. Exposure is highest where RDP is reachable from the internet or through weakly protected VPNs.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9339)
• Windows 10 Version 1809 (builds before 10.0.17763.9020)
• Windows 10 Version 21H2 (builds before 10.0.19044.7548)
• Windows 10 Version 22H2 (builds before 10.0.19045.7548)
• Windows 11 Version 23H2 (builds before 10.0.22631.7376)
• Windows 11 Version 24H2 (builds before 10.0.26100.8875)
• Windows 11 Version 25H2 (builds before 10.0.26200.8875)
• Windows 11 Version 26H1 (builds before 10.0.28000.2525)
• Windows Server 2012 (builds before 6.2.9200.26226, including Server Core)
• Windows Server 2012 R2 (builds before 6.3.9600.23291, including Server Core)
• Windows Server 2016 (builds before 10.0.14393.9339, including Server Core)
• Note: the CPE entry lists only Windows 10 1607; the CNA record lists the products above.

Fixed in

• Fixed in the Microsoft security update for each listed build (builds at or above the values above).
• Windows 10 1607 and Server 2016: 10.0.14393.9339.
• Unknown: the KB number for each product. Confirm on the MSRC page.

Workaround

• Unknown. The CVE record does not list a workaround.
• If Remote Desktop is not required, disable the RDP service.

Exploitation

• Not listed in the CISA KEV catalogue.
• CISA SSVC: exploitation none, not automatable, technical impact total.
• EPSS score 0.00364.
• No public proof of concept or exploitation report found in the sources reviewed.

Our recommendation

• Inventory all Windows hosts with RDP enabled, including build numbers and servers.
• Disable RDP where it is not needed.
• Do not expose RDP to the internet; require VPN and multi-factor authentication.
• Apply the Microsoft update for each affected build and confirm the KB on the MSRC page.
• Plan replacement of Windows 10 1607 systems. Check Microsoft's lifecycle page first; the reported end of support for this build is not verified.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-59116) msrc.microsoft.com
• Vulners NVD record CVE-2026-59116 vulners.com
• OpenCVE CVE-2026-59116 app.opencve.io
• Vulners CVE list CVE-2026-59116 vulners.com
• Strix CVE-2026-59116 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 22:11.