CVE-2026-91949

FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

Published Sep 15, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Description

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Analysis

Technical impact

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass that allows unauthenticated attackers to send incompatible protocol requests, trigger negotiation failures, then complete a TLS handshake and enter RDSTLS mode. This bypasses any server policy that restricts RDSTLS before authentication, effectively granting an attacker the ability to establish an encrypted RDP session without proper authentication. The flaw is classified as CWE-358 and CWE-693.

Affected Systems

Affected vendors include FreeRDP. The product FreeRDP, versions from 3.0.0 up to and including 3.30.0, are vulnerable.

Risk and Exploitability

Based on the description, it is inferred that attackers can exploit this vulnerability remotely over the network by sending specially crafted protocol requests to a vulnerable FreeRDP server. The flaw enables an unauthenticated attacker to complete a TLS handshake and enter RDSTLS mode even when the server policy disables RDSTLS before authentication. The EPSS score indicates a very low but non-zero probability of exploitation, while the CVSS score of 9.2 reflects critical severity. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`3.0.0`	affected	< 3.31.0
`3.31.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[3.0.0,3.31.0)`	affected	semver	—
`3.31.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FreeRDP to version 3.31.0 or later.
Block inbound RDP traffic or deny RDSTLS connections at the network perimeter.
Restrict inbound RDP traffic to known IP addresses using firewall rules.

Generated by OpenCVE AI on September 21, 2026 at 14:50 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.578% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
https://nvd.nist.gov/vuln/detail/CVE-2026-91949
https://www.cve.org/CVERecord?id=CVE-2026-91949
https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass

History

Sep 21, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-358
References		https://nvd.nist.gov/vuln/detail/CVE-2026-91949 https://www.cve.org/CVERecord?id=CVE-2026-91949
Metrics	threat_severity `None`	threat_severity `Critical`

Sep 17, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 15, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
Title		FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-693
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6 https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass
Metrics		cvssV3_1 `{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'}` cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N'}`