What is the CVSS score of CVE-2026-55626?

CVE-2026-55626 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of xrdp are affected by CVE-2026-55626?

xrdp open-source RDP server contains an authentication bypass flaw (CVE-2026-55626) enabling local users to defeat login controls and access Remote Desktop sessions without valid credentials.. A patch is available.

How to fix or mitigate CVE-2026-55626?

Within 24 hours, inventory all systems running xrdp and assess local access exposure; immediately restrict local user account creation and limit access to xrdp-enabled systems to essential personnel. Within 7 days, implement mandatory multi-factor authentication for RDP session access, enable comprehensive logging of all session attempts, and implement network segmentation to limit lateral movement. Over 30 days, evaluate upgrade paths for patched xrdp versions and complete deployment across all systems, then validate that local users cannot bypass authentication mechanisms.

xrdp CVE-2026-55626

EUVD-2026-46041 HIGH

Improper Authentication (CWE-287)

2026-07-09 vendor:ubuntu

Authentication Bypass Xrdp Neutrinolabs

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.3 HIGH

Local attack, low complexity, requires low-privilege local account; impacts confidentiality and integrity of other sessions.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

8.0 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 28, 2026 - 15:12 vuln.today

v3 (cvss_changed)

CVSS changed

Jul 28, 2026 - 15:07 NVD

8.0 (HIGH) 7.3 (HIGH)

Patch available

Jul 20, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 18:29 vuln.today

Analysis Updated

Jul 20, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 18:22 NVD

8.0 (HIGH)

Analysis Generated

Jul 09, 2026 - 15:32 vuln.today

DescriptionNVD

[Unknown description]

AnalysisAI

Authentication bypass in xrdp before version 0.10.6.1 allows a local attacker with low privileges to completely bypass authentication, gaining unauthorized access to other users' remote desktop sessions. This can lead to high confidentiality and integrity impact, such as viewing sensitive data or executing commands within the compromised session. The vulnerability is patched in version 0.10.6.1.

Technical ContextAI

xrdp is an open-source Remote Desktop Protocol (RDP) server for Linux, allowing remote graphical login. This vulnerability, classified as CWE-287 (Improper Authentication), likely stems from a flaw in how xrdp validates credentials or session authentication tokens. The affected product, identified by CPE cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*, encompasses all versions prior to 0.10.6.1. The local attack vector and low privilege requirement suggest that after gaining basic local access (e.g., via a limited shell account), an attacker can interact with the xrdp service to bypass authentication checks and hijack or initiate RDP sessions for other users.

RemediationAI

Upgrade to xrdp version 0.10.6.1 or later, as this release includes a fix for this vulnerability and others. The official release is available on GitHub: https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1. If immediate patching is not possible, restrict local access to trusted users and ensure separation of user accounts on multi-user hosts; however, these measures do not fully mitigate the bypass and should only be temporary.

More in Xrdp

View all

CVE-2026-41252 CRITICAL Act Now

9.8 Jul 09

Remote unauthenticated heap buffer overflow in xrdp (the open-source Remote Desktop Protocol server from neutrinolabs) a

CVE-2013-1430 CRITICAL Act Now

9.8 Dec 16

An issue was discovered in xrdp before 0.9.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit

CVE-2024-39917 CRITICAL Act Now

9.8 Jul 12

xrdp is an open source RDP server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no au

CVE-2022-23484 CRITICAL Act Now

9.8 Dec 09