Read the docs
TI-2022-10171 Aliases CVE-2022-26940GHSA-r3g9-4c8x-fwv7

Remote Desktop Protocol Client Information Disclosure Vulnerability

Priority LOW 34Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Remote Desktop Protocol Client Information Disclosure Vulnerability

Why it matters now

EPSS 0.02684 85th percentileScored 2026-11-07
Fix Fixed Microsoft: 2 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftRemote Desktop client for Windows Desktop1.2.0.0 to before 1.2.31301.2.3130Patch availableCNA
MicrosoftWindows Server 202210.0.20348.0 to before 10.0.20348.70710.0.20348.707Patch availableCNA
MicrosoftWindows 11 version 21H210.0.0 to before 10.0.22000.67510.0.22000.675Patch availableCNA
  • Remote Desktop client for Windows Desktop VendorMicrosoft Affected 1.2.0.0 to before 1.2.3130 Fixed in 1.2.3130 Patch available CNA
  • Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.707 Fixed in 10.0.20348.707 Patch available CNA
  • Windows 11 version 21H2 VendorMicrosoft Affected 10.0.0 to before 10.0.22000.675 Fixed in 10.0.22000.675 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:remote_desktop_client:-:*:*:*:*:windows:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
  • cpe:2.3:a:microsoft:remote_desktop_client:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft

Remediation

Microsoft 2 updates

  • KB5013944
    Security Update
    • Windows Server 2022 10.0.20348.707
    • Windows Server 2022 (Server Core installation) 10.0.20348.707
  • KB5013943
    Security Update
    • Windows 11 version 21H2 for ARM64-based Systems 10.0.22000.675
    • Windows 11 version 21H2 for x64-based Systems 10.0.22000.675

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Remote Desktop client for Windows DesktopFixed 1.2.3130 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26940
  2. 2026-10-03 Alias added: GHSA-r3g9-4c8x-fwv7

References

Patch 1

Advisory 1

  • TI-2019-00638 Path traversal in Microsoft Multiple CVSS 3.1HIGH 8.0
  • TI-2022-06374 Remote Desktop Client Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-13557 Remote Desktop Client Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-19580 Remote Desktop Client Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-01386 Windows Remote Desktop Security Feature Bypass Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-31167 Remote Desktop Client Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences