{"id":"CVE-2026-119824","kind":"vulnerability","aliases":["CVE-2026-119824"],"related":[],"title":"Windows Remote Desktop Client: missing authentication lets an attacker tamper over the network (Microsoft)","description":"Missing authentication for critical function in Remote Desktop Client allows an unauthorized attacker to perform tampering over a network.","summary":"Microsoft (CNA) lists CWE-306 missing authentication in the Remote Desktop Client component of Windows 10, Windows 11 and Windows Server 2019/2022/2025; CVSS 8.8, needs user interaction (UI:R). Fixed in the November 2026 Windows cumulative updates per the build numbers in the CVE record. No exploitation or PoC found. I could not load the MSRC page (JavaScript only), so the mechanism and any workaround are unknown.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"microsoft"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"}],"ecosystems":[],"tags":["microsoft","other","rdp","remote-desktop","windows"],"not_affected_if":[],"how_to_check":"Run winver or [Environment]::OSVersion and compare the full build (e.g. 10.0.26100.x) against the fixed builds below; anything lower is affected. Mitigations and the exact RDP client trigger are unknown until the MSRC page is read.","fix":"Install the November 2026 Windows update: 10.0.17763.9487 (Win10 1809/Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.22631.7711 (Win11 23H2), 10.0.26100.9974 (Win11 24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.20348.5870 (Server 2022), 10.0.26100.33822 (Server 2025).","status":"open","published_at":"2026-11-10T19:19:57+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","triaged_at":"2026-11-10T19:28:08+00:00","updated_at":"2026-11-10T22:51:09+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:28:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Remote Desktop Client: missing authentication lets an attacker tamper over network","impact":"medium","summary":"A missing authentication check in the Remote Desktop Client lets an unauthorized attacker tamper with data over the network. The sources do not say which vendor's client or which versions are affected.","audience":"businesses","category":"other","nicknames":[],"who_cares":["remote-desktop"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker tampers with remote desktop sessions over the network","analyst_note":"Identify the vendor and affected Remote Desktop Client versions from the NVD entry, and find whether a fix or setting is published.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000621,"input_tokens":4491,"output_tokens":343,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and affected Remote Desktop Client versions from the NVD entry, and find whether a fix or setting is published.","search":"'-119824':17A,20A '-2026':16A,19A '-306':64B '10':22A,27A,30A,75B '11':33A,36A,39A,42A,45A,77B '1809':23A '2019':25A '2019/2022/2025':81B '2022':49A '2025':52A '2026':93B '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':40A '26h1':46A '26h2':43A '8.8':83B 'allow':136C 'attack':9A,139C 'authent':6A,66B,128C 'build':99B 'client':4A,71B,135C 'cna':61B 'compon':72B 'could':111B 'critic':130C 'cumul':95B 'cve':15A,18A,103B 'cvss':82B 'cwe':63B 'desktop':3A,58B,70B,134C 'exploit':106B 'fix':89B 'found':109B 'function':131C 'interact':86B 'javascript':117B 'let':7A 'list':62B 'load':113B 'mechan':121B 'microsoft':14A,53B,60B 'miss':5A,65B,127C 'msrc':115B 'need':84B 'network':13A,145C 'novemb':92B 'number':100B 'page':116B 'per':97B 'perform':141C 'poc':108B 'r':88B 'rdp':55B 'record':104B 'remot':2A,57B,69B,133C 'remote-desktop':56B 'server':24A,48A,51A,80B 'tamper':10A,142C 'ui':87B 'unauthor':138C 'unknown':126B 'updat':96B 'user':85B 'window':1A,59B,74B,76B,79B,94B 'windows':21A,26A,29A,32A,35A,38A,41A,44A,47A,50A 'workaround':124B","nicknames":[],"mitigations":[],"who_affected":"Windows 10, Windows 11 and Windows Server machines below the fixed builds that use the built-in Remote Desktop Client (mstsc/RDP). Exploitation needs user interaction, probably connecting to or opening something an attacker controls, but the source does not say. Machines already patched to the November 2026 builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809server2019","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2022","server2025","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["high","microsoft","other","rdp","remotedesktop","windows"],"campaign_type":null,"search_a":"'-119824':17A,20A '-2026':16A,19A '10':22A,27A,30A '11':33A,36A,39A,42A,45A '1809':23A '2019':25A '2022':49A '2025':52A '21h2':28A '22h2':31A '23h2':34A '24h2':37A '25h2':40A '26h1':46A '26h2':43A 'attack':9A 'authent':6A 'client':4A 'cve':15A,18A 'desktop':3A 'let':7A 'microsoft':14A 'miss':5A 'network':13A 'remot':2A 'server':24A,48A,51A 'tamper':10A 'window':1A 'windows':21A,26A,29A,32A,35A,38A,41A,44A,47A,50A","search_b":"'-306':64B '10':75B '11':77B '2019/2022/2025':81B '2026':93B '8.8':83B 'authent':66B 'build':99B 'client':71B 'cna':61B 'compon':72B 'could':111B 'cumul':95B 'cve':103B 'cvss':82B 'cwe':63B 'desktop':58B,70B 'exploit':106B 'fix':89B 'found':109B 'interact':86B 'javascript':117B 'list':62B 'load':113B 'mechan':121B 'microsoft':53B,60B 'miss':65B 'msrc':115B 'need':84B 'novemb':92B 'number':100B 'page':116B 'per':97B 'poc':108B 'r':88B 'rdp':55B 'record':104B 'remot':57B,69B 'remote-desktop':56B 'server':80B 'ui':87B 'unknown':126B 'updat':96B 'user':85B 'window':59B,74B,76B,79B,94B 'workaround':124B","search_c":"'allow':136C 'attack':139C 'authent':128C 'client':135C 'critic':130C 'desktop':134C 'function':131C 'miss':127C 'network':145C 'perform':141C 'remot':133C 'tamper':142C 'unauthor':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119824","severity":null,"published_at":"2026-11-10T19:19:57+00:00","modified_at":"2026-11-10T19:19:57+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","fetched_at":"2026-11-10T19:24:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119824:3056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119824","severity":null,"published_at":"2026-11-10T22:51:09+00:00","modified_at":"2026-11-10T22:51:09+00:00","first_seen_at":"2026-11-10T22:51:09+00:00","fetched_at":"2026-11-10T22:51:09+00:00","note":"Vendor/versions/fixed builds from NVD page carrying Microsoft CNA data; MSRC page unreadable (JS), so nothing marked verified. No exploitation or PoC found; no posts searched.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-119824"]}],"documents":[{"id":119771,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119824","title":"NVD CVE-2026-119824 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}