CVE-2026-32105

CVE-2026-32105 is a high-severity vulnerability in Neutrinolabs Xrdp with a CVSS 3.x base score of 7.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-354.

Key facts

Description

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.

Frequently asked questions

What is CVE-2026-32105?
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.
How severe is CVE-2026-32105?
CVE-2026-32105 has a CVSS 3.x base score of 7.7, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2026-32105 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-32105?
CVE-2026-32105 affects Neutrinolabs Xrdp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-32105?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-32105 have an EU (EUVD) identifier?
Yes. CVE-2026-32105 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-23472.
When was CVE-2026-32105 published?
CVE-2026-32105 was published on 2026-04-17 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Neutrinolabs Xrdp

All CVEs affecting Neutrinolabs Xrdp →

Other CWE-354 vulnerabilities

Browse all CWE-354 vulnerabilities →