Windows Server CVE-2024-43455

Exploitation requires that the target Windows Server has the Remote Desktop Licensing (RD Licensing / Terminal Services Licensing) role service installed and enabled, and that the attacker can reach its licensing/RPC endpoint over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed once that service is reachable. The principal limiting factor is therefore deployment-specific: only servers actually running the RD Licensing role - typically in RDS/VDI environments - are exposed, so hosts without the role or with the licensing ports firewalled off are not reachable. Whether exploitation works against fully default configurations depends on the RD Licensing role being present, which is not a default Windows Server role.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes a remotely reachable, low-complexity, unauthenticated attack with no user interaction and total impact - the worst-case profile. EPSS reinforces urgency: 4.80% probability is modest in absolute terms but the 90th percentile places it among the more exploitation-likely CVEs. However, key signals are missing or in tension: this is NOT listed in CISA KEV and no public exploit is identified, so active exploitation is unconfirmed. More importantly, there is a semantic conflict - Microsoft's title and the tags call this 'Spoofing' / 'Information Disclosure', which normally implies limited integrity/confidentiality impact, yet the CVSS vector asserts C:H/I:H/A:H. This discrepancy should be verified against the MSRC advisory before treating this as a full RCE-equivalent; the 9.8 may reflect Microsoft's spoofing-scoring conventions rather than direct arbitrary code execution. Net: patch promptly given the network-unauthenticated profile and high EPSS percentile, but validate the true impact class with the vendor.

An attacker with network access to a Windows Server running the RD Licensing role sends a crafted licensing-protocol message that abuses the service's improper input validation to spoof a trusted party in the client/server licensing exchange, without any credentials or user interaction. Given the AV:N/AC:L/PR:N profile, this could be attempted by any host able to reach the licensing port. No public exploit is identified at time of analysis, so weaponization effort would fall on the attacker.