Insufficient user interface warnings for dangerous operations in Windows Remote Desktop enable an unauthorized attacker to perform spoofing over a network, allowing the attacker to impersonate a legitimate remote session. This identity spoofing can lead to authentication bypass or credential theft and is classified as an instance of CWE‑357.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 edition, including both full installations and Server Core variants. Both x86, x64 and arm64 architectures are impacted as listed in the CPE entries.

The CVSS score of 7.1 reflects moderate‑to‑high potential impact. No EPSS score is presently available, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can exploit the flaw via the Remote Desktop Protocol, bypassing visual security cues to spoof an authentic session. Given the widespread use of RDP across corporate, government and cloud environments, the combination of a broad affected base and a network‑based attack vector increases the likelihood of real‑world exploitation.