Windows RDP CVE-2026-58594

Exploitation requires network reachability to the Windows RDP service (typically TCP/UDP 3389) on an unpatched host; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, privileges, or user interaction are needed against a listening RDP endpoint. The practical limiting factors are that the RDP service (Remote Desktop) must be enabled and reachable - many hosts do not expose RDP externally, and firewalling, VPN/RD Gateway fronting, or Network Level Authentication constrain who can reach the vulnerable pre-auth code path. CISA SSVC further marks the flaw as Automatable: no, suggesting exploitation may need a specific condition or code path not spelled out in the terse description; the exact triggering RDP feature is not detailed in the available data and should be confirmed via the Microsoft advisory.

The signals are mixed and worth weighing carefully. CVSS 3.1 rates this 9.8 Critical with AV:N/AC:L/PR:N/UI:N - network reachable, low complexity, no privileges, no user interaction, and total confidentiality/integrity/availability impact - which on paper is a wormable-class RCE. However, CISA's SSVC framework records Exploitation: none and Automatable: no (with Technical Impact: total), and EPSS is only 0.78% at the 52nd percentile, indicating no observed exploitation and no evidence of easy mass-automation yet. These lower-tempo signals contrast with the maximal CVSS and should be read as 'high latent severity, low current activity': the vulnerability is a top patching priority given RDP's exposure, but there is no confirmation of in-the-wild use. Note the SSVC 'Automatable: no' somewhat tempers the wormable interpretation an AC:L network RCE would otherwise imply - this may reflect a non-trivial exploitation prerequisite (e.g. reaching a specific RDP code path) not captured in the terse description; verify exploitation details with Microsoft's advisory.

An attacker who can reach an exposed RDP endpoint (e.g. an internet-facing or lateral-network host on port 3389) sends a crafted RDP message that triggers an integer overflow during size/length handling, corrupting memory and gaining code execution with no credentials and no user interaction. Because CVSS is AV:N/AC:L/PR:N/UI:N with total impact, a single reachable host could be fully compromised; however, no public proof-of-concept has been identified and SSVC marks exploitation as not currently automatable.