CVE Watch20 jul 2026

CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend ov

CVSS

8.0

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 20 jul 2026 · Última mod.: 20 jul 2026 · CWE-287 · CWE-306

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-32489.8 CRÍ

100.0%

KEV—80Langflow Missing Authentication Vulnerability7d CVE-2024-116809.8 CRÍ

99.8%

KEV—80ProjectSend Improper Authentication Vulnerability7d CVE-2026-561645.3 MED

92.1%

KEV—78Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability7d CVE-2026-468179.8 CRÍ

60.4%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability2h CVE-2023-278239.8 CRÍ

98.9%

——30An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.12d CVE-2022-245629.8 CRÍ

98.9%

——30In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.12d