Dashboard / CVE-2026-55626

CVE-2026-55626

HIGH
MEDIUM Priority: 0.01 BB Relevance: 40/100
Published: 2026-07-20 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: Low

Description

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
neutrinolabs xrdp 0.10.3 – 0.10.6.1

References & Advisories (2)

Bug Bounty Relevance

40 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.3 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS — Exploitation Probability

0.19%
Raw Score 0.001870
Percentile 8.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00187
2026-10-28
0.00187

Intelligence Sources

nvd ref →

External Links