VulnSocial

CVE-2026-56190Disclosure(microsoft / windows_10_1607)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch microsoft windows_10_1607 systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

microsoft CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-908

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • Peaked 4d ago at 2 mentions (2026-07-15); latest day: 1
  • 6 total mentions across 5 days

Affected systems

Vendors
microsoft
Products
windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016windows_server_2019

2 versions affected across 12 products

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-07-15: 2Mentions · 2026-07-16: 1Mentions · 2026-07-20: 1Mentions · 2026-07-22: 1Mentions · 2026-08-14: 1Active Exploitation · 2026-07-16: 1Patch / Workaround · 2026-07-15: 2Patch / Workaround · 2026-07-20: 1Technical Details · 2026-07-15: 2Technical Details · 2026-07-16: 1Technical Details · 2026-07-20: 1Technical Details · 2026-08-14: 107-1507-1607-2007-2208-14
Signal classification4 categories
Disclosure
233.3%
Patch
233.3%
Active Exploitation
116.7%
General
116.7%
Referenced assets22 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-152
Disclosure1Patch1
2026-07-161
Active Exploitation1
2026-07-201
Patch1
2026-07-221
General1
2026-08-141
Disclosure1
Full discourse6 posts
  • Autumn Good@autumn_good_35
    Active Exploitation

    今月気になるのは、既に悪用されていて今後も悪用されそうなADFSの権限昇格（CVE-2026-56155）、認証不要でのRDPのRCE（CVE-2026-56190）、あとはOWAでメール開くだけでスクリプト実行できる（CVE-2026-55008）は悪用されそうですね。 The July 2026 Security Update Review https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review

    Post summary

    The tweet highlights CVE‑2026‑56155, CVE‑2026‑56190, and CVE‑2026‑55008 as actively exploited or likely to be exploited, citing privilege escalation, RDP RCE, and OWA script execution respectively.

    200311.4K
    7.1K followersView on X
  • National CERT/CC@CERT_UG
    Patch

    #PatchAlert: Windows Remote Desktop Protocol Server Unauthenticated RCE Patched in July 2026 Patch Tuesday (CVE-2026-56190)- https://cert.ug/windows-remote-desktop-protocol-server-unauthenticated-rce-patched-july-2026-patch-tuesday-cve-2026

    Post summary

    A patch alert confirms that the unauthenticated RCE issue (CVE-2026-56190) in Windows RDP has been addressed with a July 2026 update.

    01010104
    1.4K followersView on X
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-56190: Windows RDP Remote Code Execution Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04t2Wr40

    Post summary

    The snippet announces a newly disclosed Windows RDP RCE vulnerability, but provides no PoC, exploit code, patch, or evidence of active exploitation.

    0000042
    32 followersView on X
  • Jan Guldentops@JanGuldentops
    General

    Alle individuele kwetsbaarheden uit de post met hun rechtstreekse link naar de European Vulnerability Database (EUVD) van ENISA: Active Directory Federation Services privilege escalation (CVE-2026-56155): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56155 BitLocker encryptieomzeiling (CVE-2026-50661): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-50661 Remote Desktop kwetsbaarheid (CVE-2026-56190): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56190 Hyper-V virtual machine escape (CVE-2026-57092): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-57092 Cisco VoIP kwetsbaarheid (CVE-2026-20150): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20150 Cisco SD-WAN kwetsbaarheid (CVE-2026-20182): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20182 Google Chrome bug 1 (CVE-2026-6811): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6811 Google Chrome bug 2 (CVE-2026-6812): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6812 Google Chrome bug 3 (CVE-2026-6813): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6813 Curl kwetsbaarheden range (CVE-2026-22834 t/m CVE-2026-22851): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-22834 Fortinet FortiSandbox securitylek 1 (CVE-2026-25089): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-25089 Fortinet FortiSandbox securitylek 2 (CVE-2026-39808): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39808 SonicWall SMA1000 server-side request forgery (CVE-2026-15409): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15409 SonicWall SMA1000 code injection en privesc (CVE-2026-15410): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15410 WordPress zero day (CVE-2026-63030): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-63030 Linux Kernel ip6_tunnel RCE ( CVE-2026-43037) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43037 • • Linux kernel XFRM IPSEc ESP bug ( CVE-2026-43284 ) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43285

    Post summary

    A brief compilation of CVEs with corresponding EUVD links, offering basic identification but no deeper technical or exploit information.

    00000171
    1.9K followersView on X
  • Windows Forum@windowsforum
    Patch

    🪟 RDP bugs don’t need an invitation—CVE-2026-56190 scores 9.8 and lets attackers run code unauthenticated. Patch July 14, or let your login screen become public infrastructure. https://windowsforum.com/threads/cve-2026-56190-patch-windows-rdp-9-8-rce-in-july-2026.438782/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PatchManagement #RemoteDesktopProtocol #Cve202656190 https://t.co/eMnhYhA5BU

    Post summary

    The post highlights CVE‑2026‑56190, a critical RDP flaw permitting unauthenticated code execution, and announces an official patch due on July 14, urging users to apply it to avoid exposing their login screen.

    0000067
    1.2K followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🖥️ CVE-2026-56190: Critical unauthenticated RCE in Windows RDP. Uninitialized resource flaw lets attackers execute code over the network — no credentials, no interaction. Affects Windows 10/11 and multiple Server versions. Patch now. https://secalerts.co/vulnerability/CVE-2026-56190?utm_campaign=x https://t.co/xR6kMRTQlm

    Post summary

    A critical unauthenticated RCE vulnerability in Windows RDP (CVE-2026-56190) affecting Windows 10/11 and server versions has been disclosed, with technical details provided and a patch now available.

    00000126
    858 followersView on X
CPE platform detail15 entries

15 of 15 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2---
OSmicrosoftwindows_10_22h2---
OSmicrosoftwindows_11_24h2---
OSmicrosoftwindows_11_25h2---
OSmicrosoftwindows_11_26h1---
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2025---

Explore more

Back to dashboardmicrosoft CVEswindows_10_1607 vulnerabilities