{"id":"CVE-2026-95964","kind":"vulnerability","aliases":["CVE-2026-95964"],"related":[],"title":"Windows Remote Desktop Client: race condition lets attacker run code remotely","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Race condition (CWE-362) in the Windows Remote Desktop Client lets an unauthorized attacker execute code over a network. Microsoft's CVSS 7.5 (AV:N/AC:H/PR:N/UI:R): high attack complexity and user interaction required. No exploitation or public PoC found. Details come from the CVE record Microsoft published via NVD; the MSRC page could not be read (JavaScript-only).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","rdp","remote-desktop","windows","windows-server"],"not_affected_if":[],"how_to_check":"Check the Windows build (winver, or [System.Environment]::OSVersion) against the fixed builds: Win10 1607/Server 2016 < 10.0.14393.9688; 1809/Server 2019 < 10.0.17763.9487; Win10 21H2/22H2 < 10.0.19044.7846 / 10.0.19045.7846; Server 2022 < 10.0.20348.5870; Win11 23H2 < 10.0.22631.7711; Win11 24H2/25H2 < 10.0.26100.9974 / 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974; Server 2025 < 10.0.26100.33822. Prioritise machines that connect to RDP servers they do not control.","fix":"Install the November 2026 Windows cumulative update that raises the build to at least the fixed number for your version (listed in how-to-check). KB numbers not confirmed; take them from the MSRC page.","status":"open","published_at":"2026-11-10T19:21:52+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:42:55+00:00","updated_at":"2026-11-10T20:19:01+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Remote Desktop Client: race condition lets attacker run code remotely","impact":"high","summary":"A race condition in the Remote Desktop Client lets an unauthorized attacker execute code over the network. The sources give no further detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker executes code on the affected client over the network","analyst_note":"Confirm affected Remote Desktop Client versions and the vendor fix from the Microsoft advisory for CVE-2026-95964; the NVD entry gives only the description.","how_to_check":"- Check the Remote Desktop Client version on Windows machines that use it, against the vendor's advisory for CVE-2026-95964\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running the Remote Desktop Client connect to remote hosts, so the risk sits on the client side. The sources do not say which client versions or configurations are affected. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4505,"output_tokens":452,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Remote Desktop Client versions and the vendor fix from the Microsoft advisory for CVE-2026-95964; the NVD entry gives only the description.","search":"'-2026':13A,16A '-362':42B '-95964':14A,17A '10':28A '11':19A '2022':26A '2025':23A '22h2':29A '24h2':20A '7.5':61B 'allow':113C 'attack':8A,52B,68B,116C 'av':62B 'client':4A,48B,112C 'code':10A,54B,119C 'come':81B 'complex':69B 'concurr':99C 'condit':6A,40B,108C 'could':93B 'cve':12A,15A,84B 'cvss':60B 'cwe':41B 'desktop':3A,34B,47B,111C 'detail':80B 'execut':53B,100C,118C 'exploit':75B 'found':79B 'h/pr':64B 'high':67B 'improp':105C 'infrastructur':30B 'interact':72B 'javascript':98B 'javascript-on':97B 'let':7A,49B 'microsoft':58B,86B 'msrc':91B 'n/ac':63B 'n/ui':65B 'network':57B,122C 'nvd':89B 'page':92B 'poc':78B 'public':77B 'publish':87B 'r':66B 'race':5A,39B,107C 'rdp':31B 'read':96B 'record':85B 'remot':2A,11A,33B,46B,110C 'remote-desktop':32B 'requir':73B 'resourc':103C 'run':9A 'server':22A,25A,38B 'share':102C 'synchron':106C 'unauthor':51B,115C 'use':101C 'user':71B 'via':88B 'window':1A,35B,37B,45B 'windows':18A,21A,24A,27A 'windows-serv':36B","nicknames":[],"mitigations":[],"who_affected":"Machines running the Remote Desktop Client connect to remote hosts, so the risk sits on the client side. The sources do not say which client versions or configurations are affected. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1124h2","server2022","server2025","windows1022h2","windows1124h2","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2022","2025","22h2","24h2","server","windows"],"labels":["high","infrastructure","rdp","remotedesktop","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':13A,16A '-95964':14A,17A '10':28A '11':19A '2022':26A '2025':23A '22h2':29A '24h2':20A 'attack':8A 'client':4A 'code':10A 'condit':6A 'cve':12A,15A 'desktop':3A 'let':7A 'race':5A 'remot':2A,11A 'run':9A 'server':22A,25A 'window':1A 'windows':18A,21A,24A,27A","search_b":"'-362':42B '7.5':61B 'attack':52B,68B 'av':62B 'client':48B 'code':54B 'come':81B 'complex':69B 'condit':40B 'could':93B 'cve':84B 'cvss':60B 'cwe':41B 'desktop':34B,47B 'detail':80B 'execut':53B 'exploit':75B 'found':79B 'h/pr':64B 'high':67B 'infrastructur':30B 'interact':72B 'javascript':98B 'javascript-on':97B 'let':49B 'microsoft':58B,86B 'msrc':91B 'n/ac':63B 'n/ui':65B 'network':57B 'nvd':89B 'page':92B 'poc':78B 'public':77B 'publish':87B 'r':66B 'race':39B 'rdp':31B 'read':96B 'record':85B 'remot':33B,46B 'remote-desktop':32B 'requir':73B 'server':38B 'unauthor':51B 'user':71B 'via':88B 'window':35B,37B,45B 'windows-serv':36B","search_c":"'allow':113C 'attack':116C 'client':112C 'code':119C 'concurr':99C 'condit':108C 'desktop':111C 'execut':100C,118C 'improp':105C 'network':122C 'race':107C 'remot':110C 'resourc':103C 'share':102C 'synchron':106C 'unauthor':115C 'use':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95964","severity":null,"published_at":"2026-11-10T19:21:52+00:00","modified_at":"2026-11-10T19:21:52+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95964:2638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95964","severity":null,"published_at":"2026-11-10T20:19:01+00:00","modified_at":"2026-11-10T20:19:01+00:00","first_seen_at":"2026-11-10T20:19:01+00:00","fetched_at":"2026-11-10T20:19:01+00:00","note":"Only the Microsoft-CNA data on NVD was readable (MSRC page is JS-only, Exa search had no vendor page). Builds taken from it but nothing marked verified; KBs, mitigations and exploitation status unconfirmed. Tier B.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-95964"]}],"documents":[{"id":118004,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95964","title":"NVD CVE-2026-95964 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}