Windows RDP Client EUVD-2026-73176

Exploitation requires an attacker to be positioned on the network path between the victim's Remote Desktop client for Windows Desktop and the RDP server or Azure Virtual Desktop gateway - a man-in-the-middle position. The victim must be using the standalone RDP client in a version range of 1.2.0.0 to below 1.2.7279.0. Modern JWT-based authentication flows (such as Azure AD/Entra ID SSO for Azure Virtual Desktop) must be in use rather than classic NTLM/Kerberos-only authentication, given the 'Jwt Attack' technique tag. No attacker privileges are required and no user interaction beyond initiating an RDP session is needed. Exploitation is limited to confidentiality impact - no integrity or availability abuse is possible through this vector alone.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a high-severity, no-prerequisite network vulnerability with total confidentiality impact. The AC:L rating warrants scrutiny: exploiting a signature verification bypass in a client-server protocol typically requires network positioning - a man-in-the-middle setup - which would argue for AC:H rather than AC:L, so the vendor-assigned complexity may be optimistic. Even so, a mid-sized IT deployment in gdynia relying on the standalone RDP client for Azure Virtual Desktop access should treat this with urgency, since a successful exploit could expose JWT session tokens, credentials, or identity assertions that enable lateral movement or account takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so mass exploitation is not currently observed. The zero integrity and availability impact limits blast radius to information theft, but in identity-centric cloud RDP environments, credential-level exposure is equivalent to full session compromise.

An attacker positioned on the network path between a user running the unpatched Remote Desktop client and the RDP/Azure gateway presents a forged or modified JWT with an invalid signature during the authentication handshake. Because the client fails to reject the malformed signature per CWE-347, the attacker can intercept the legitimate authentication token or inject a crafted one, extracting session credentials or identity assertions. No public exploit code has been confirmed, but the attack is conceptually straightforward for an adversary with network MITM capability.