home / blog
2026-11-02 · critical
CVE-2026-56190: Critical RCE in Windows RDP, public exploit
Critical RCE in Windows RDP, CVSS 9.8. Public exploit today. Server 2022 at risk. Urgent mitigations needed.
CVE-2026-56190 is a critical uninitialized resource vulnerability in Windows RDP service. Improper initialization allows an unauthenticated attacker to remotely execute arbitrary code on any affected system connected to a network. Windows Server 2022 is confirmed as affected by current public signals.
The vulnerability carries CVSS score 9.8, classified critical by official source. Published July 14, 2026. Nearly four months later, November 2, 2026, a public exploit signal was detected claiming full RCE chain that bypasses system-level protections. This indicates active exploitation risk.
Security teams must: 1) Immediately inventory Windows Server 2022 systems with RDP exposed to internet or untrusted networks; 2) Apply official patches when available; 3) Implement network segmentation to limit RDP access and enable multi-factor authentication; 4) Monitor RDP access logs and anomalous connection attempts.
At a glance
- What
- Uninitialized resource use in Windows RDP allowing unauthenticated remote code execution over network.
- Severity
- CVSS 9.8 (critical). Remotely exploitable without authentication.
- Affected versions
- Windows Server 2022 confirmed by public signal. Complete specifications not reported in NVD description.
- Fix
- not reported
- Status
- Public exploit confirmed November 2, 2026. Vulnerability published July 14, 2026.
- Action
- Immediately assess RDP internet exposure. Apply patch when available. Network segmentation and MFA on RDP access.
Sources: NVD, CVE-2026-56190