Windows Server 2012 EUVD-2026-22545

User must interact with (click/open) a malicious RDP connection invitation. Remote Desktop Client must be installed and enabled. No authentication required; attack occurs during connection establishment phase.

The CVSS 8.8 score reflects high severity with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R). This user interaction requirement significantly constrains exploitation scenarios compared to fully remote exploits, as victims must initiate RDP connections to attacker-controlled or compromised servers, or open malicious .rdp connection files. No public exploit identified at time of analysis and absence from CISA KEV indicates this is not yet weaponized in active campaigns. However, the technical characteristics suggest high automatable potential once weaponized: network-based exploitation with low complexity enables scalable attacks via phishing emails containing malicious RDP files or social engineering users to connect to rogue servers. The complete CIA impact triad (C:H/I:H/A:H) means successful exploitation grants full system compromise at user privilege level. Real-world risk is elevated for organizations with users regularly connecting to external or third-party RDP servers, but mitigated by the interaction requirement and patch availability. Priority classification: high-priority patching for RDP-dependent environments, moderate priority for systems with restricted RDP usage. SSVC decision framework alignment: exploitation status is none, automatable is yes once POC exists, technical impact is total system compromise-warranting scheduled patching within standard cycles for most organizations, accelerated for high-value RDP gateway infrastructure.

An attacker hosts a malicious RDP server or compromises a legitimate one, then socially engineers targets through phishing emails containing