CVE-2025-55340CWE-287

Windows Remote Desktop Protocol Security Feature Bypass

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

⚡ An authorized user can bypass security features entirely in Windows Remote Desktop Protocol—it's like having a backstage pass that lets you skip the line! 🎟️ Think of it like having a VIP ticket to a concert, allowing you to waltz past security and into the best seats without needing to show your ID. This vulnerability lets an attacker with local access slide right past the defenses that should keep them out. If exploited, this vulnerability could allow an attacker to access sensitive areas of the system that should remain off-limits, potentially leading to unauthorized data access or manipulation. It's a serious breach of trust that could have devastating consequences for the integrity of your systems.

Put simply

Think of it like having a VIP ticket to a concert, allowing you to waltz past security and into the best seats without needing to show your ID. This vulnerability lets an attacker with local access slide right past the defenses that should keep them out. The flaw lies in improper authentication within the Remote Desktop Protocol, enabling an authorized user to bypass security checks and gain unauthorized access to resources they shouldn't have access to.

What to do

If exploited, this vulnerability could allow an attacker to access sensitive areas of the system that should remain off-limits, potentially leading to unauthorized data access or manipulation. It's a serious breach of trust that could have devastating consequences for the integrity of your systems. To mitigate this, ensure that your systems are updated with the latest security patches from Microsoft that address this issue. Review user permissions and enforce strong authentication practices to limit access to trusted individuals only. ⚠️ You've got this! By taking these steps, you can help secure your systems and keep the bad guys out! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-10-14T17:00Z
EPSS history
Timeline
  • 14 OCT 17:00Z
    Windows Remote Desktop Protocol Security Feature Bypass
    cvelistv5