Suse CVE-2026-33689

Upgrade to xrdp version 0.10.6 immediately, as confirmed by vendor release tag v0.10.6 at https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 and security advisory GHSA-92mr-6wpp-27jj. For Linux distributions, apply vendor-provided security updates when available through package managers (apt, yum, dnf). If immediate patching is not feasible, implement network-level compensating controls: restrict xrdp access (default TCP port 3389) to trusted IP ranges via firewall rules or place behind VPN gateway, eliminating exposure to untrusted networks. This mitigation reduces attack surface but does not eliminate risk from authenticated network users or lateral movement scenarios. For high-security environments unable to patch within 72 hours, consider temporarily disabling xrdp service and using alternative remote access methods (SSH with X11 forwarding, VNC over SSH tunnel). Note that network restrictions may impact legitimate remote users and require coordination with IT operations. Verify patch application by checking xrdp version with 'xrdp --version' command post-upgrade. Monitor xrdp process logs for abnormal connection attempts or crashes that may indicate exploitation attempts against unpatched systems.