Windows Server 2012 CVE-2026-26151

User interaction required to click through insufficient UI warnings in Windows Remote Desktop Protocol connections. Attacker must initiate network-based RDP session with crafted malicious parameters to trigger spoofing of security dialogs.

Real-world risk is moderate-to-high despite the 7.1 CVSS score. The CVSS vector reveals favorable attacker conditions: network-based attack (AV:N), low complexity (AC:L), and no privileges required (PR:N), though user interaction is necessary (UI:R). The high confidentiality impact (C:H) with low integrity impact (I:L) suggests attackers can intercept sensitive session data but have limited ability to modify systems directly. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not yet actively exploited in the wild. However, the widespread deployment of RDP across enterprise environments, combined with the low technical barrier to exploitation, creates significant attack surface. EPSS probability data is unavailable, but the combination of unauthenticated network access and social engineering (tricking users past warnings) makes this automatable once weaponized. The SSVC decision framework would likely classify this as medium priority: exploitation status is none/PoC, automatable is yes (social engineering can be scaled), and technical impact is partial (credential theft without direct code execution). Organizations heavily reliant on RDP for remote access should prioritize patching, particularly in environments where users regularly initiate outbound RDP connections.

An attacker sets up a rogue RDP server or performs a man-in-the-middle attack on network traffic between a victim and a legitimate RDP server. When the victim attempts to connect via Remote Desktop, the attacker intercepts the connection and presents a spoofed certificate or connection parameters. Due to insufficient UI warnings in the RDP client, the victim does