Executive brief
A security vulnerability exists in Windows Remote Desktop, a tool used by employees to access computers and servers remotely. An attacker could trick a user into performing a dangerous action because the system fails to provide a clear enough warning about the risks. If successful, an attacker could impersonate legitimate services or systems, potentially leading to the theft of sensitive information.
Technical details
A spoofing vulnerability exists in Windows Remote Desktop due to insufficient UI warnings for dangerous operations (CWE-357). The vulnerability allows a remote, unauthenticated attacker to perform spoofing over a network, provided they can convince a user to interact with a malicious element (User Interaction required). Successful exploitation could allow an attacker to gain unauthorized access to sensitive information or misrepresent system state to the user. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 R2
Timeline
- 2026-04-14: disclosed: Initial disclosure by Microsoft
- 2026-04-14: advisory: NVD published the CVE record
- 2026-05-26: other: NVD record modified with additional references
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151
- https://www.vicarius.io/vsociety/posts/cve-2026-26151-detection-script-spoofing-vulnerability-affecting-windows-remote-desktop
- https://www.vicarius.io/vsociety/posts/cve-2026-26151-mitigation-script-spoofing-vulnerability-affecting-windows-remote-desktop