Loading story…
RustDesk addressed CVE-2026-57850 in version 1.4.9, fixing a server-side authorization flaw that let an authenticated peer in a limited session send control messages and login options intended only for a full Remote session. The vulnerability affects versions before 1.4.9 and could allow an attacker with low privileges to exceed the permissions granted for session types such as FileTransfer, PortForward, ViewCamera, or Terminal, potentially gaining broader visibility or control over the host. The issue is tracked as CWE-862 and carries a high-severity CVSS 3.1 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
The fix was introduced through pull request #15469 and commit 493b14ba78abc3dfb33f109c7f93c1c95a1dabc4, which enforce session-scoped permissions across authenticated connection types and block out-of-scope login, option, and control messages. RustDesk also added auditing and explicit close reasons for scoped-session violations, limited clipboard synchronization and screenshot handling to appropriate contexts, and prevented actions such as privacy mode or virtual display changes in view-camera sessions. The security changes were shipped as part of the broader 1.4.9 release.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-57850 was published describing a missing session scope enforcement issue in RustDesk before 1.4.9 that could let an authenticated remote peer exceed granted permissions and observe or control the host beyond the authorized scope.
RustDesk released version 1.4.9, the version referenced as fixing the session scope enforcement flaw affecting earlier releases.
RustDesk merged a commit implementing session-scope permission enforcement, adding auditing and close reasons for scoped-session violations and tightening controls for clipboard, screenshot, privacy mode, and display-related actions.
A RustDesk pull request introduced changes to enforce session-scoped permissions across authenticated connection types, restricting limited sessions to allowed message types and filtering out-of-scope login and option messages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
RustFS disclosed and fixed **CVE-2026-73284**, an improper privilege management flaw in the `AddServiceAccount` handler that could let an authenticated low-privilege user create a service account tied to the root credential. The vulnerable logic checked only `CreateServiceAccountAdminAction` and accepted an attacker-controlled `target_user`, which was then passed into service-account creation without confirming that the requested parent account was within the caller’s scope. RustFS said the resulting account could be marked as owner-authenticated through `prepare_service_account_auth`, creating a path to full compromise of confidentiality, integrity, and availability. The issue is tracked as **GHSA-5354** and carries a **CVSS 3.1** score of **9.1** with vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. Maintainers addressed the bug in **RustFS `1.0.0-beta.11`** by adding scope enforcement so non-owners can create service accounts only for themselves or, when using derived credentials, for their own parent account, while owners retain broader cross-user creation rights. The project also merged regression tests covering both the original non-owner abuse case and derived-credential attack scenarios to prevent the authorization bypass from reappearing.
Aug 12, 2026
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026
Microsoft released fixes for two **Windows Remote Desktop Protocol (RDP)** information disclosure vulnerabilities, `CVE-2026-42908` and `CVE-2026-45639`, that allow a remote, unauthenticated attacker to trigger out-of-bounds reads and expose sensitive memory without user interaction. According to reporting on the June 9, 2026 security updates, `CVE-2026-42908` can disclose local memory addresses and weaken **ASLR**, while `CVE-2026-45639` can reveal process memory including credentials, session tokens, and protocol state data. Microsoft rated both flaws **Important** with **CVSS 7.5** and said exploitation was considered less likely at release, with no public exploits reported. The vulnerabilities affect a broad set of Windows platforms, including **Windows 10**, **Windows 11**, **Windows Server 2012 through 2025**, and Microsoft’s Remote Desktop client offerings for Windows desktop. The disclosures arrive amid continued scrutiny of the RDP ecosystem after earlier reports of severe Remote Desktop weaknesses, including `CVE-2025-29967` in **RD Gateway** and `CVE-2025-29966` and `CVE-2025-48817` in the **Windows Remote Desktop Client**, which were described as enabling remote code execution through heap overflow or path traversal conditions. Organizations were urged to prioritize patching internet-exposed RDP systems and strengthen access controls with VPNs, bastion hosts, strong authentication, and monitoring.
Jun 29, 2026