CVE-2026-56190
A flaw in the Remote Desktop Protocol (RDP) in Microsoft Windows allows an attacker to run malicious code on a system. This happens because the system fails to properly initialize a specific resource during the connection process.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running various versions of Microsoft Windows 10, Windows 11, and Windows Server (including 2012, 2012 R2, 2016, 2019, 2022, and 2025).
Real-world impact
An attacker could remotely take control of a computer or server without needing any login credentials or user interaction.
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without any user interaction or authentication, allowing for full control over the affected system.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory