CVE-2026-56190

What it actually does

CVE-2026-56190 is a network-accessible remote code execution vulnerability in Microsoft Windows Remote Desktop Protocol services caused by use of an uninitialized resource. An unauthenticated attacker who can reach the RDP service could send specially crafted RDP traffic that causes the vulnerable service to use invalid or attacker-influenced memory/resource state, potentially resulting in arbitrary code execution. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U with high confidentiality, integrity, and availability impact, successful exploitation could give the attacker code execution on the targeted Windows host without valid credentials or user interaction.

Why it matters to the business

Systems exposing RDP on affected Windows desktop or server versions are at risk of full host compromise, service disruption, credential theft, lateral movement, and deployment of follow-on malware. The issue is critical severity and affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, making it operationally important for enterprises with remote administration, jump hosts, VDI, or externally reachable RDP. It is not currently listed in CISA KEV and no mature exploit is reported in the supplied data, but the combination of network reachability, no authentication requirement, and high impact warrants urgent patching and exposure reduction.

How an attack unfolds

An attacker first identifies hosts with RDP exposed, typically on TCP port 3389 or behind a Remote Desktop gateway or forwarding rule. The attacker then initiates an RDP connection and sends malformed or specially crafted protocol data intended to trigger the uninitialized resource handling flaw in the Windows RDP service. If the vulnerable code path is reached, the service may execute attacker-controlled code in the context of the RDP service process, crash, or enter an unstable state. After gaining code execution, the attacker would commonly establish persistence, disable defenses, dump credentials from memory or registry-backed stores, enumerate the network, and use the compromised host as a foothold for lateral movement. Where exploitation is unreliable, repeated crashes of Remote Desktop Services may be visible before successful compromise.

How to fix it

Apply the Microsoft security update or cumulative update that addresses CVE-2026-56190 for all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Update Catalog, or endpoint management tooling to install the latest applicable cumulative security update released on or after the vendor fix. Where immediate patching is not possible, reduce exposure by disabling RDP on systems that do not require it, blocking direct inbound RDP from the internet, restricting RDP to VPN or RD Gateway paths, enforcing Network Level Authentication where compatible, limiting access to known management subnets, and applying host firewall rules to TCP/3389 and any alternate RDP ports. Harden RDP by requiring MFA at the access layer, disabling local administrator RDP access where feasible, restricting clipboard and drive redirection, and monitoring privileged logons.

How to confirm the fix worked

Confirm remediation by verifying that every affected Windows host has installed the applicable Microsoft cumulative security update that includes the fix for CVE-2026-56190. Validate through centralized patch inventory, Windows Update history, installed hotfix/build reporting, vulnerability scanner authenticated checks, or Microsoft Update compliance reports. Confirm that unnecessary RDP listeners are disabled and that required RDP services are reachable only from approved management networks, VPNs, or RD Gateway infrastructure. From a network perspective, verify that TCP/3389 and any alternate RDP ports are not exposed to untrusted networks. From a host perspective, confirm Remote Desktop configuration, firewall scope, Network Level Authentication settings, and recent service stability. Re-run vulnerability scans after patching and after reboot if the update requires one.

Typical attack path

1. Scan the internet or internal address space for systems accepting RDP connections, commonly TCP/3389.
2. Fingerprint the target to identify affected Windows desktop or server versions and exposed Remote Desktop services.
3. Send crafted RDP protocol traffic to trigger the uninitialized resource condition before authentication or without valid credentials.
4. Achieve code execution in the vulnerable RDP service context, or cause service crashes while refining the exploit.
5. Run post-exploitation commands, stage payloads, or create a reverse shell or remote management channel.
6. Collect credentials and host information, then pivot to other systems using RDP, SMB, WinRM, or domain credentials.
7. Deploy persistence, defense-evasion tooling, ransomware, or additional malware depending on the attacker objective.

How to detect it

To determine whether exploitation may already have occurred, review Windows security logs, Remote Desktop Services logs, endpoint telemetry, crash dumps, EDR process events, and network flow data. Focus on systems with RDP exposed before patching. Look for unusual inbound RDP connection attempts from unknown external IPs, repeated failed or partial RDP handshakes, Remote Desktop Services crashes or restarts, and successful Logon Type 10 sessions from unfamiliar addresses. Correlate RDP activity with process creation events showing unexpected child processes from service-hosted Remote Desktop components, command shells, PowerShell, script interpreters, credential dumping tools, or newly created services. Review Windows Error Reporting and Application logs for svchost.exe crashes involving Terminal Services or RDP components. Network teams should inspect firewall, VPN, RD Gateway, IDS/IPS, and NetFlow records for spikes in TCP/3389 traffic or scanning against RDP endpoints. Because no public exploit maturity or campaign-specific indicators were supplied, detections should emphasize behavioral evidence: pre-auth RDP anomalies, service instability, suspicious post-RDP process execution, new local accounts, privilege changes, persistence artifacts, and lateral movement shortly after RDP contact.

• TCP/3389
• Logon Type: 10
• Event ID 1149
• Event ID 4624
• Event ID 4625
• Event ID 4778
• Event ID 4779
• Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
• Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
• Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
• Remote Desktop Services: User authentication succeeded
• Faulting application name: svchost.exe
• Faulting module name: termsrv.dll
• TermService
• Remote Desktop Services service terminated unexpectedly
• C:\Windows\System32\termsrv.dll
• C:\Windows\System32\svchost.exe
• C:\Windows\System32\rdpclip.exe
• mstsc.exe

What your security team should do

• Prioritize patching internet-facing RDP servers, jump hosts, domain-joined servers, VDI infrastructure, and systems used by administrators.
• Immediately inventory RDP exposure across external and internal networks, including nonstandard ports and NAT or firewall forwarding rules.
• Block direct inbound RDP from the internet wherever possible; require VPN, RD Gateway, conditional access, and MFA for remote administration.
• Use authenticated vulnerability scanning or endpoint management data to identify affected Windows versions missing the relevant cumulative security update.
• Increase monitoring for RDP service crashes, anomalous inbound RDP attempts, successful RDP logons from unusual sources, and post-exploitation activity following RDP connections.
• Review privileged account usage over RDP and enforce least privilege, credential hygiene, and local administrator password randomization.
• If patching is delayed, apply compensating controls: restrict firewall scope, disable RDP on nonessential hosts, isolate high-value servers, and add IDS/IPS coverage for anomalous RDP traffic.
• Because the issue was published 28 days ago and has critical severity, treat remediation as time-sensitive even though it is not currently in CISA KEV and no mature exploit is reported in the supplied data.