Windows Remote Desktop CVE-2026-59116

Exploitation requires the attacker to occupy a privileged man-in-the-middle position on the network path between the Remote Desktop client and server (reflected by AC:H), and requires a victim to actually initiate an RDP session (UI:R) - it is not a self-contained remote trigger against an idle listener. The flaw lies in Windows Remote Desktop's use of a broken/risky cryptographic algorithm, so the security-feature protection it undermines is only meaningful for RDP traffic that relies on that algorithm; deployments enforcing stronger transport protections (e.g., TLS-pinned/NLA-hardened or VPN-tunneled RDP) and network segmentation that denies on-path positioning substantially limit realistic exploitation. No privileges on the target are needed (PR:N), but the on-path requirement plus user interaction are the key limiting factors.

This is a medium-severity (CVSS 6.8) security feature bypass in Windows Remote Desktop rooted in a weak/broken cryptographic algorithm (CWE-327). The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) tells a consistent story: although the attacker needs no privileges (PR:N), exploitation is gated by High attack complexity (AC:H) and required user interaction (UI:R), which together point to a man-in-the-middle / interception scenario where the attacker must already hold a privileged network position and a victim must initiate an RDP session. The high Confidentiality and Integrity impact (C:H/I:H) with no Availability impact is typical of a crypto bypass that lets an attacker decrypt or tamper with the session rather than crash the service. On real-world prioritization signals there is NO EPSS score, NO CISA KEV listing, and NO public POC provided in the input, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent (no high-CVSS-but-obviously-overstated conflict), but the combination of AC:H + UI:R materially lowers practical risk below what the 6.8 base score alone suggests: this is a defense-in-depth/MITM-class issue, not a mass-exploitable RCE. Note one metadata caveat: the 'Authentication Bypass' tag is narrower than the description's generic 'security feature bypass' and should be verified against the Microsoft advisory before treating this strictly as an auth bypass.

An attacker positioned on the network path (e.g., via ARP spoofing or rogue gateway on a shared/corporate LAN) waits for a user to initiate a Remote Desktop connection, then exploits the weak cryptographic algorithm to defeat an RDP security protection and intercept or tamper with the session, exposing credentials or session data. The high attack complexity reflects the need for that privileged on-path position plus a victim connection (UI:R). No public exploit code was identified in the provided data.