Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91949FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

Critical 9.3

In plain English

A critical-severity security flaw in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-12.el10_2.13ALSA-2026:73979
AlmaLinux:10freerdp-devel2:3.10.3-12.el10_2.13ALSA-2026:73979
AlmaLinux:10freerdp-libs2:3.10.3-12.el10_2.13ALSA-2026:73979
AlmaLinux:10freerdp-server2:3.10.3-12.el10_2.13ALSA-2026:73979
AlmaLinux:10libwinpr2:3.10.3-12.el10_2.13ALSA-2026:73979
AlmaLinux:10libwinpr-devel2:3.10.3-12.el10_2.13ALSA-2026:73979
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-91949
Debian:14freerdp33.31.0+dfsg-1DEBIAN-CVE-2026-91949
Rocky Linux:10freerdp2:3.10.3-12.el10_2.13RLSA-2026:73979
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-91949
Ubuntu:24.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-91949
Ubuntu:26.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-91949

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 3.0.0 – before 3.31.0

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References