Windows Remote Desktop client link-following flaw allows RCE (CVE-2026-119824)
Original title: ZDI-26-967: Microsoft Windows Remote Desktop Connection Client Link Following Remote Code Execution Vulnerability
A user must connect to a malicious server; ZDI rates the issue CVSS 7.5 and names no patch.
ZDI published ZDI-26-967, a link-following flaw in the Microsoft Windows Remote Desktop Connection client. Remote attackers can run arbitrary code if the user connects to a malicious server. ZDI assigns CVSS 7.5 and CVE-2026-119824. The advisory does not state a fixed version or exploitation status.
Unconfirmed: The advisory does not state whether a patch exists or whether the flaw is exploited.
- User interaction is required to connect to a malicious server.
- ZDI CVSS score is 7.5.
- The assigned identifier is CVE-2026-119824.
- No affected or fixed Windows versions are stated.
Impact: Remote arbitrary code execution after user connects
| Product | Affected |
|---|---|
| Microsoft Windows Remote Desktop Connection Client | — |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119824 | Missing authentication in Microsoft Remote Desktop Client | 8.8 | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.