PT-2026-120173

CVE-2026-114047

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 4.0

7.6

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0

Description An improper certificate validation issue exists in the proxy component. When no verification module is configured, the proxy accepts untrusted target TLS certificates. This allows network-positioned attackers to intercept outbound connections by presenting a self-signed certificate with an incorrect hostname, enabling them to impersonate the RDP target and capture proxied session data.

Recommendations Update FreeRDP to version 3.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products