by Kastro
Paper/Archive/CVE-2026-91949

CVE-2026-91949

FreeRDP FreeRDP — FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 47.6.476 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Affected

ProductAffectedFixed inSource
FreeRDP3.0.0 – < 3.31.03.31.0CNA

Scores by source

VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6writeupvulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass