CVE-2026-66402Patch(freerdp / freerdp)

HIGHCVSS 9.3 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch freerdp freerdp systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts

Recommended action window: Immediate (within 24h)

NVD description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

freerdp CVEs Back to dashboard

6.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-43hh-p3vw-hfx3

Weakness type (CWE)

CWE-295

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

freerdp

Threat summary

Active exploitation appears in 1 classified signals
Exploit tooling references are present in monitored signal
Patch or workaround signal is available
4 mentions across 2 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-08-01); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

freerdp

Products

freerdp

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

General

125.0%

Active Exploitation

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-01	3	General1Patch2
2026-08-04	1	Active Exploitation1

Full discourse4 posts

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc89d
Active Exploitation
Critical zero-days: SonicWall SMA 1000 (CVE-2026-15409/10) exploited by ransomware & FreeRDP TLS bypass (CVE-2026-66402) found. Immediate patching vital to safeguard data privacy/integrity in transit. #Cybersecurity #News
Post summary
The post highlights that the SonicWall SMA 1000 zero‑day CVEs (CVE‑2026‑15409/10) were actively exploited by ransomware, urging immediate patching to protect data in transit.
0001097
16 followersView on X
ADK Cyber@ADKCyber91d
Patch
FreeRDP versions <=3.28.0 contain high-severity TLS certificate validation weaknesses (CVSS 9.8). Update to 3.29.0 if deployed. https://nvd.nist.gov/vuln/detail/CVE-2026-66402 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/T4e4IVBvuG
Post summary
The tweet reports a high‑severity TLS certificate validation issue in FreeRDP versions ≤3.28.0 (CVE‑2026‑66402) and recommends upgrading to 3.29.0.
0000039
90 followersView on X
Security Arsenal, LLC@SecurityAr5840991d
General
🔒 #CyberSecurity CVE-2026-66402: Critical OpenSSL Remote Execution — Detection & Hardening "A critical vulnerability has been identified in OpenSSL, designated CVE-2026-66402. This flaw…" 🔗 https://securityarsenal.com/blog/cve-2026-66402-critical-openssl-remote-execution-detection-and-hardening #CyberSecurity #ThreatIntel #cve202666402 #critical #cve
Post summary
The tweet announces a critical OpenSSL remote execution vulnerability (CVE-2026-66402), providing basic technical details but no exploit, PoC, patch or evidence of active exploitation.
0000047
20 followersView on X
Upwind Security MDR@UpwindMDR91d
Patch
🚨Critical - Two FreeRDP client flaws: TLS cert-validation bypass and HTTP proxy request injection (CVE-2026-66402 & CVE-2026-67289) Both affect FreeRDP <= 3.28.0 and are fixed in 3.29.0. CVE-2026-66402 (CWE-295): FreeRDP does custom CN/DNS-SAN matching instead of OpenSSL's length-aware APIs, so it truncates DNS SANs at embedded NUL bytes, accepts a matching Common Name even when non-matching SANs are present, and accepts IP-literal targets without checking iPAddress SANs. An attacker who can present a trusted or misissued certificate can bypass server identity verification and MitM the RDP session. CVE-2026-67289 (CWE-113): FreeRDP doesn't validate CRLF/control chars in the server-controlled RDP redirection TargetNetAddress. When the client connects through an HTTP proxy, that value is written unfiltered into the proxy CONNECT line and Host header, letting a malicious server inject arbitrary requests/headers into the proxy connection. Both are client-side MitM-class bugs, CVSS 9.8. FreeRDP underpins many remote-desktop tools, so the footprint is broad. 👉Upgrade FreeRDP to 3.29.0 (also fixes the clipboard RCE CVE-2026-67305).
Post summary
Two critical FreeRDP client vulnerabilities are disclosed, technical details are provided, and the patches are available in version 3.29.0, with an explicit upgrade recommendation.
00000130
278 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	freerdp	freerdp	-	-	-

Explore more

Back to dashboard freerdp CVEs freerdp vulnerabilities

What researchers are saying

CVE-2026-66402

ADK Cyber[verified]@ADKCyberPatch

The tweet reports a high‑severity TLS certificate validation issue in FreeRDP versions ≤3.28.0 (CVE‑2026‑66402) and recommends upgrading to 3.29.0.

Security Arsenal, LLC[verified]@SecurityAr58409General

The tweet announces a critical OpenSSL remote execution vulnerability (CVE-2026-66402), providing basic technical details but no exploit, PoC, patch or evidence of active exploitation.

Upwind Security MDR[verified]@UpwindMDRPatch

Two critical FreeRDP client vulnerabilities are disclosed, technical details are provided, and the patches are available in version 3.29.0, with an explicit upgrade recommendation.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircActive Exploitation

The post highlights that the SonicWall SMA 1000 zero‑day CVEs (CVE‑2026‑15409/10) were actively exploited by ransomware, urging immediate patching to protect data in transit.