This vulnerability arises from the use of a broken or risky cryptographic algorithm in the Windows Remote Desktop Protocol. An attacker who can gain network access to a system running one of the affected versions can bypass a security feature that normally protects Remote Desktop communications. The weakness corresponds to CWE‑327, which relates to the use of a broken or risky algorithm.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2 (x86 and arm64), 24H2 (arm64), 25H2 (arm64), 26H1 (x64); Microsoft Windows Server 2012 (x64), Windows Server 2012 R2 (x64), Windows Server 2016 (all architectures), Windows Server 2019 (all architectures), Windows Server 2022 (all architectures), and Windows Server 2025 (all architectures).

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is unavailable, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network‑based, requiring the ability to initiate a Remote Desktop session or otherwise interact with the RDP service. An attacker who succeeds can bypass the intended security feature on the host.