CVE-2026-58535

What it actually does

This vulnerability is an information disclosure flaw in Windows Remote Desktop Protocol caused by use of an uninitialized resource. A remote, unauthenticated attacker can cause affected Windows RDP components to expose sensitive memory or protocol data over the network. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and user interaction required; confidentiality impact is high, with no direct integrity or availability impact. The flaw does not by itself provide code execution, but leaked information may help an attacker bypass protections, recover sensitive data, or support follow-on exploitation.

Why it matters to the business

Organizations exposing RDP on affected Windows clients or servers may risk leakage of sensitive information without attacker authentication. Even though there is no known public exploit maturity or CISA KEV listing at this time, the issue affects many supported Windows desktop and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. The primary operational concern is that exposed or heavily used RDP services could reveal data useful for credential theft, lateral movement, or chaining with other vulnerabilities, increasing risk to remote administration infrastructure.

How an attack unfolds

An attacker identifies a reachable RDP service on an affected Windows system and initiates crafted RDP communication designed to trigger use of an uninitialized resource. Because the flaw is remotely reachable and does not require authentication, the attacker can attempt exploitation before completing a valid login. The attack path may require interaction from a user or RDP workflow component, consistent with the UI:R scoring. If successful, the RDP service discloses sensitive information back over the network. The attacker then analyzes the leaked data for memory contents, session-related information, or other values that could aid follow-on attacks. There is currently no reported public exploit maturity and the vulnerability is not listed in CISA KEV, but externally exposed RDP remains a high-value target and should be prioritized for patching or access restriction.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management. Because exact fixed build numbers were not provided, validate against Microsoft’s official advisory and installed cumulative update level for each affected platform. Where immediate patching is not possible, reduce exposure by disabling RDP where it is not required, blocking direct internet access to TCP/3389, requiring VPN or secure remote access gateways, enforcing Network Level Authentication, limiting allowed source networks, and monitoring for unusual RDP negotiation activity. Prioritize internet-facing servers, remote access gateways, domain controllers, administrative jump hosts, and systems used for privileged administration.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft security update that addresses this vulnerability for its specific OS version. Use enterprise patch inventory, Windows Update history, Microsoft Update compliance reporting, or PowerShell-based hotfix/build checks to verify the latest cumulative update level. Validate externally that RDP is not directly reachable from untrusted networks unless explicitly required. For systems where RDP must remain enabled, confirm Network Level Authentication is enabled, firewall rules restrict access to approved management networks, and remote access is routed through controlled gateways. Vulnerability scanners should be updated with checks for this CVE and run against Windows desktop and server assets to confirm remediation status.

Typical attack path

1. Scan the internet or internal network for hosts exposing RDP, commonly TCP/3389.
2. Fingerprint the target to identify affected Windows client or server versions.
3. Initiate crafted unauthenticated RDP negotiation or session traffic intended to trigger the uninitialized resource condition.
4. Satisfy any required user-interaction-dependent condition or rely on normal RDP workflow behavior where applicable.
5. Receive and capture information disclosed by the vulnerable RDP component.
6. Analyze leaked data for sensitive values that can support credential attacks, bypasses, reconnaissance, or chaining with other vulnerabilities.

How to detect it

To assess possible prior exploitation, review RDP-related logs and network telemetry for unusual unauthenticated connection patterns, malformed or repeated RDP negotiation attempts, and unexpected traffic to TCP/3389 from untrusted sources. Useful Windows log sources include Security event logs for logon activity, TerminalServices-RemoteConnectionManager, TerminalServices-LocalSessionManager, RemoteDesktopServices-RdpCoreTS operational logs, Windows Defender Firewall logs, VPN or remote access gateway logs, EDR network telemetry, IDS/IPS alerts, and packet captures where available. Look for high-volume failed or incomplete RDP handshakes, connection attempts that do not progress to normal authentication, repeated probes across many hosts, and RDP traffic from scanning infrastructure or unfamiliar geographies. Because this is an information disclosure issue and no public exploit indicators are known, detection will likely be behavioral rather than based on a single definitive artifact. Correlate suspicious RDP probing with subsequent credential attacks, lateral movement, or successful logons from the same source addresses.

• TCP/3389
• Event Log: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
• Event Log: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
• Event Log: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
• Windows Security Event ID 4624 LogonType=10
• Windows Security Event ID 4625 LogonType=10
• Windows Security Event ID 4778
• Windows Security Event ID 4779
• TermService
• svchost.exe -k termsvcs

What your security team should do

• Inventory all Windows systems running RDP, especially internet-facing hosts and privileged administrative systems.
• Apply Microsoft security updates for affected Windows 10, Windows 11, and Windows Server versions once validated for the operating environment.
• Restrict RDP exposure by blocking direct access from the internet and allowing only approved VPN, bastion, or management network sources.
• Enable and enforce Network Level Authentication for RDP wherever operationally feasible.
• Review firewall, security group, and perimeter rules for open TCP/3389 and remove unnecessary exposure.
• Increase monitoring for unauthenticated or abnormal RDP connection attempts, especially to servers and remote access gateways.
• Prioritize remediation despite the absence of KEV status because the vulnerability is network-reachable, unauthenticated, and affects a broad Windows estate.
• Run authenticated vulnerability scans or patch compliance checks to verify all affected systems are updated.