External risk intelligence

FreeRDP Protocol Negotiation Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-91949

FreeRDP is a remote desktop implementation frequently used to provide remote access services and gateways. Because this vulnerability affects the protocol negotiation and connection establishment phase of a remote access server, it is public-facing by design in common deployments that provide remote desktop connectivity.

Freerdp

3.0.0 to before 3.31.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in FreeRDP server software that could allow unauthenticated attackers to bypass security policies and establish unauthorized remote desktop connections. This bypass occurs during the protocol negotiation phase, potentially enabling access despite server configurations designed to prevent it. The main concern is confirming relevance and exposure, as this could impact systems providing remote access services.

Unauthenticated bypass of remote connection security.
Affects remote access gateways and services.
Confirm if this impacts your remote access systems.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by sending specially crafted protocol requests to a vulnerable FreeRDP server. This bypasses security checks, allowing them to establish an RDSTLS connection even if the server is configured to disallow it, potentially leading to further compromise.

Network access required.
Incompatible protocol requests trigger bypass.
Allows unauthenticated connections.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass pre-authentication restrictions and establish secure RDP connections to systems running FreeRDP servers. This bypass could occur when an attacker sends incompatible protocol requests, leading to negotiation failures, followed by a successful TLS handshake for RDSTLS.

Unauthenticated access to remote desktop services.
Bypass server policy for secure connections.
Unauthorized remote system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FreeRDP server allows unauthenticated attackers to bypass security policies and establish RDSTLS connections. Technical leaders and security teams should prioritize identifying all instances of the affected FreeRDP server, confirming their exposure and business criticality, and assigning ownership for remediation. The first practical step involves discovering where FreeRDP is deployed, assessing its reachability and importance, and then developing a risk-based remediation plan.

Application or infrastructure owners should address.
Verify external reachability and asset criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeRDP and how is it used?

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP). It is widely used to build remote access gateways and server applications that allow users to connect to remote desktop environments. Because it acts as the foundation for these connectivity services, it is typically deployed where reliable, secure remote communication between clients and servers is required.

What does the CVE-2026-91949 vulnerability mean?

This vulnerability is classified as a protection mechanism failure (CWE-693). It allows an attacker to bypass security configurations on a FreeRDP server. Even if a system administrator has specifically disabled RDSTLS connections to enforce tighter security, the vulnerability lets an attacker force a connection that circumvents these pre-authentication restrictions.

How do attackers trigger this FreeRDP bypass?

An attacker triggers the bypass by interacting with the protocol negotiation phase of the connection. They send incompatible protocol requests to the server, which causes an initial negotiation failure. This specific sequence tricks the server, allowing the attacker to proceed with a TLS handshake and successfully establish an RDSTLS connection. Simply connecting normally to the server does not trigger this flaw.

Do I need to worry about this if my server is internal?

According to Halo Surface Signal, this vulnerability is particularly significant for servers that are public-facing by design, such as remote access gateways. If your FreeRDP instance is exposed to the internet, it is at higher risk. Internal systems are generally safer, but they remain relevant if they are accessible from untrusted segments of your network.

What should I do first to address CVE-2026-91949?

Your first step is to locate all instances of FreeRDP within your environment. Once you have an inventory, assess which of these systems are reachable from the network or the internet and evaluate their business importance. Use this information to coordinate with the relevant infrastructure owners to prioritize updates for the most critical and exposed servers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.