Remote Desktop Client CVE-2026-61352

The vulnerable component is the Windows Remote Desktop Client (mstsc.exe or equivalent RDP client stack), meaning exploitation requires a victim system to initiate or accept an RDP client session toward an attacker-controlled server. The CVSS vector PR:N and UI:N indicate no privileges are required on the attacker's side and no explicit user interaction beyond the connection itself is needed - however, the target must be running the RDP client and connecting to the malicious endpoint, which in practice often involves social engineering or a rogue server in a trusted network path. The critical limiting factor is AC:H: the race condition requires the attacker to win a precise timing window during concurrent execution, which is not reliably achievable in a single attempt and is explicitly rated non-automatable by CISA SSVC. Exploitation is therefore constrained to targeted, manual efforts rather than automated scanning campaigns. No specific non-default configuration is identified as required; the RDP client feature is present by default on Windows desktop and server editions.

The CVSS 8.1 score reflects genuinely severe potential impact - full confidentiality, integrity, and availability compromise - but the High Complexity (AC:H) modifier is the critical signal here, as race conditions by nature require precise timing and are not trivially or reliably reproducible. EPSS places this at only 0.44% exploitation probability (36th percentile), which is low, consistent with CISA SSVC's 'Exploitation: none' and 'Automatable: no' designations. The AC:H and non-automatable SSVC assessment together indicate that mass, spray-style exploitation is unlikely; however, the 'Technical Impact: total' SSVC rating confirms that a successful exploit delivers complete system compromise. Despite the low EPSS, the breadth of affected systems - spanning virtually every supported Windows SKU - means that even a mid-sized municipal IT team in gniezno should treat this as urgent patching work, since even a low per-system probability compounds across a large Windows estate. There is no conflict between available data signals: all sources consistently characterize this as high-impact but operationally complex to exploit, with no observed exploitation at time of analysis.

An attacker operates or controls a malicious RDP server and induces a target Windows user or automated system to connect to it via the Remote Desktop Client. During the connection or session handling phase, the attacker sends a sequence of crafted protocol messages designed to trigger a race condition in the client's shared resource handling, exploiting the narrow timing window to redirect execution flow. If the timing is achieved - which requires precision and may need multiple attempts given AC:H - the attacker achieves arbitrary code execution in the context of the RDP client process on the victim machine. No public exploit code is known at time of analysis.