Windows Remote Desktop Protocol CVE-2026-70587

Remote Desktop Protocol (TCP/3389) must be enabled and reachable from the attacker - the only prerequisite. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special configuration, no authentication, and no victim interaction are needed beyond network connectivity to the RDP listener. This means any Windows host with RDP exposed to an untrusted network (internet, shared tenant network, or guest VLAN) is exploitable in its default RDP-enabled state. Exploitation is limited by network access: hosts protected by a firewall that blocks TCP/3389 from untrusted sources, or those routing RDP through an RD Gateway requiring prior authentication, reduce the effective attack surface. The vulnerability does not enable code execution directly - impact is confined to information disclosure from process memory.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately captures the key risk drivers: no authentication, no user interaction, full confidentiality impact over the network. The primary risk-multiplier is scale - RDP is universally deployed across Windows Server environments and routinely exposed to the internet or corporate networks, meaning the attack surface is enormous. The S:U scope designation and absence of Integrity/Availability impact limit the worst-case outcome to information disclosure (e.g., session tokens, credentials, or other in-process memory fragments), not direct code execution. No EPSS score was provided in the input; no KEV listing or public POC is recorded, suggesting exploitation has not been widely observed. However, pre-authentication RDP bugs historically attract rapid weaponization, and the breadth of affected versions means unpatched exposure will persist for years. Priority patching is warranted for any host with RDP accessible beyond a trusted network boundary.

An unauthenticated attacker on the internet sends a specially crafted RDP connection initiation sequence to TCP/3389 on a vulnerable Windows Server host, triggering the improper null termination defect during pre-authentication message parsing. The server reads beyond the string boundary and returns adjacent process memory - which could contain fragments of other sessions' credentials, authentication tokens, or sensitive configuration data - in the protocol response. No public exploit code is identified at time of analysis, but the pre-auth, zero-interaction vector makes scripted scanning and exploitation straightforward once a working payload is developed.