Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires multiple conditions to be met. The attacker must have access to a user's machine and the user must have initiated an RDP session. The attack must also be carried out within a certain amount of time from the initiation of the RDP session.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This vulnerability could allow an attacker to bypass RDP authentication.
Security updates
10.0.26200.6899 — https://support.microsoft.com/help/5066835
10.0.20348.4294 — https://support.microsoft.com/help/5066782
10.0.19044.6456 — https://support.microsoft.com/help/5066791
10.0.22621.6060 — https://support.microsoft.com/help/5066793
10.0.25398.1913 — https://support.microsoft.com/help/5066780
Vulnerabilities 1
-
High 7.0
Windows Remote Desktop Protocol Security Feature Bypass
Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
References
-
CVE-2025-55340 Windows Remote Desktop Protocol Security Feature Bypass - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55340
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss