Remote Desktop Client CVE-2026-61363

The target system must be running an unpatched Windows Remote Desktop Client on any of the affected Windows 10, Windows 11, or Windows Server 2012-2025 releases. The critical limiting factor is that the victim's RDP client must establish an outbound connection to an attacker-controlled or attacker-intercepted RDP server - the vulnerability is on the client side and cannot be exploited by a passive listener or through unsolicited inbound traffic alone. The attacker must therefore either operate a malicious RDP server that victims are socially engineered or redirected to connect to, or obtain a man-in-the-middle position on the network path of an existing RDP session. SSVC confirms the attack is not automatable at scale, ruling out opportunistic mass exploitation. No non-default feature flag or special software configuration is required beyond the client initiating an RDP connection to an attacker-reachable endpoint. The high attack complexity (AC:H) from the CVSS vector confirms these prerequisites are non-trivial.

The CVSS 8.1 score is anchored by AV:N/AC:H/PR:N/UI:N with full C/H/I/H/A:H impact, reflecting that network exploitation requires no privileges and theoretically no user interaction. However, the AC:H component is the critical tempering factor: an attacker must control a malicious RDP server or occupy a man-in-the-middle position on the network path - this is non-trivial at scale. The EPSS score of 0.64% (47th percentile) is strikingly low for an 8.1 CVSS vulnerability, aligning with the CISA SSVC assessment that exploitation is currently 'none' and the attack is 'not automatable.' There is a notable inconsistency worth flagging: the Microsoft CVSS vector claims UI:N (no user interaction), yet the client-side nature of this flaw - where the victim's RDP client must connect to an attacker-controlled server - strongly implies at least passive or active user involvement. The SSVC 'not automatable' finding further contradicts UI:N. This discrepancy should be verified with the vendor; defenders should not assume fully automated, zero-click exploitation is confirmed. SSVC rates technical impact as 'total,' consistent with the full RCE potential. Overall: real risk exists but is conditional; treat as high priority for patching but not as an active emergency given no KEV listing and low EPSS.

An attacker registers or compromises an RDP server and distributes a malicious RDP file or phishing link that directs victims to connect to the attacker's endpoint - alternatively, the attacker performs DNS spoofing or ARP poisoning to redirect an existing RDP session. When the victim's Windows RDP client connects, the server returns a specially crafted protocol message that overflows a heap buffer during parsing, granting the attacker code execution in the security context of the connecting user. No public proof-of-concept exploit has been identified at time of analysis.