EUVD-2026-45345
GHSA-g46q-9m87-q8fx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable web endpoint exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N); disclosure-only impact gives C:H, I:N, A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4) allows unauthenticated remote attackers to read private personal information over the network without user interaction. The CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.55%, 42nd percentile) suggests limited near-term exploitation likelihood despite the network-reachable, unauthenticated vector.
Technical ContextAI
The affected components are Microsoft's browser-based RDP gateway layer: the Remote Desktop Web Client (the HTML5 client used to reach RDP session hosts through a web browser) and Windows Admin Center (the web-based server management console that embeds remote session functionality). The root cause is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), meaning the application returns or leaks personally identifiable or sensitive session data to a party not authorized to receive it. The CPE data (cpe:2.3:a:microsoft:remote_desktop_web_client and cpe:2.3:a:microsoft:windows_admin_center) confirms these are the two distinct application-layer products carrying the flaw, both delivering RDP access over web/HTTP transport rather than the raw RDP protocol port.
RemediationAI
Vendor-released patch: upgrade Remote Desktop Web Client to 2.1.65.2 or later and Windows Admin Center to 2.7.4 or later, following the fixed-version guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56171. Until patching is complete, reduce exposure by restricting network access to the Remote Desktop Web Client and Windows Admin Center endpoints - place them behind a VPN or reverse proxy with authentication, and limit source IPs to management networks rather than exposing them to the public internet; the trade-off is reduced remote administrative convenience for offsite operators. Because this is a confidentiality-only flaw with no integrity/availability impact, network-level access restriction is an effective compensating control while the update is staged.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Windows Admin Center fails to properly validate cryptographic signatures, enabling high-privileged users to bypass secur
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today