CVE-2026-91949

CVE Details

Release Date:	2026-09-15
Impact:	Critical	What is this?

Description

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

See more information about CVE-2026-91949 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	9.3
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	Low
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (freerdp)	ELSA-2026-73979	2026-09-30