Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-57098: Windows Remote Desktop client can leak data to attackers

CVE-2026-57098 · published 1 month ago

Summary

The Remote Desktop client for Windows does not correctly check a security signature, so a malicious party on the same network could view information they shouldn’t see. This could expose sensitive data being transmitted during a remote session. Apply the latest Microsoft update for the Remote Desktop client or disable the feature until it is patched.

What to do

Update microsoft remote desktop client for windows desktop to version 1.2.7279.0 or later.
Update microsoft remote_desktop_client to version 1.2.7279 or later.

Affected software

Vendor	Product	Affected versions
microsoft	remote desktop client for windows desktop	< 1.2.7279.0
microsoft	remote_desktop_client	< 1.2.7279 `cpe:2.3:a:microsoft:remote_desktop_client::::::windows::*`

Original advisory text

Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57098 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-347Improper Verification of Cryptographic Signature

Timeline

Published8 Sep 2026

Updated4 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-57098 · NVD

CVE-2026-57098 · MITRE

Track software like this

Free during beta