Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-17 | 1 | Disclosure1 |
| 2026-04-18 | 2 | Disclosure2 |
| 2026-04-28 | 1 | Patch1 |
CVE-2026-32105 xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted R… https://www.cve.org/CVERecord?id=CVE-2026-32105
Post summary
The post notes a MAC verification flaw in xrdp versions through 0.10.5, providing a brief technical description but no evidence of PoC, exploitation, or patch.
BREAKING: Fedora 44 and 42 ship critical xrdp flaws (CVE-2026-32105, -32107, -32623, -32624, -33145, -33516, -33689, -35512) enabling RCE, privilege escalation and DoS, patch to 0.10.6 now. https://threatcluster.io/cluster/critical-xrdp-vulnerabilities-in-fedora-44-and-42-require-im-c7dd5323
Post summary
The post alerts that Fedora 44 and 42 include critical xrdp flaws (CVE‑2026‑32105, ‑32107, ‑32623, ‑32624, ‑33145, ‑33516, ‑33689, ‑35512) that enable remote code execution, privilege escalation, and denial‑of‑service, and notes a patch (0.10.6) is available now.
🚨*CVE* CVE-2026-32105 xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted R… https://www.cve.org/CVERecord?id=CVE-2026-32105 ----- Traducción: CVE-2026-32105 xrd… http://infoflow.cloud`
Post summary
The post references CVE-2026-32105 and explains that xrdp versions 0.10.5 and earlier lack MAC verification for encrypted RDP sessions, but does not provide any PoC, exploit, or patch information.
🚨 CVE-2026-32105: xrdp:... MITM paradise: xrdp silently ignores MAC signatures in classic RDP mode, letting attackers modify encrypted traffic undetected #RDPsecurity #MITM. https://zerodaysignal.com/vulnerability/CVE-2026-32105 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet reveals a new CVE (CVE-2026-32105) affecting xrdp, highlighting a MAC signature bypass that enables MITM attacks, but no PoC, exploit code, patch, or active exploitation claims are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | neutrinolabs | xrdp | - | - | - |