CVE-2026-91949CWE-693

CVE-2026-91949

Critical · published September 15, 2026

CVSS v3.1
9.3
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00562 · 46.0th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-09-15T20:17Z
Affected products (1)
ProductVersionsFixed in
freerdp/freerdp≥ 3.0.0, < 3.31.03.31.0
References (2)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6 · [email protected]https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:18Z
    FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
    cvelistv5