CVEFinder.io

CVE-2026-56171

⚠️ high
🔍 Scan for this CVE
Summary

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.

CVSS Score
7.1
High
EPSS Score
0.5
Exploit Probability
Published Date
2026-07-17
First Seen: 2026-07-18
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 53.2% of all 338,292 vulnerabilities in our database.

#158,486
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 21, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-07-22
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CWE IDs (Weakness Types)
CWE-359

📦 Affected Products 2

Vendor Product Status Affected Versions
microsoft windows_admin_center Affected
< 2606
microsoft remote_desktop_web_client Affected
< 2.1.65.2

🔗 References 1

https://msrc.microsoft.com/update-guide/vulnerabilit...
Vendor Advisory Release Notes

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-58643 🔶 medium 6.1 0.2 Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an u... 2026-07-16
CVE-2026-56169 ⚠️ high 8.1 0.5 Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. 2026-07-14
CVE-2026-56185 🔶 medium 6.5 0.6 Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network. 2026-07-14
CVE-2026-57107 ⚠️ high 7.8 0.2 Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally. 2026-07-14
CVE-2026-58631 ⚠️ high 7.8 0.3 Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally. 2026-07-14
CVE-2026-56196 ⚠️ high 8.8 1.0 Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network. 2026-07-14
These CVEs affect the same products