Microsoft disclosed a maximum-severity remote code execution vulnerability in the Windows Remote Desktop Protocol server on July 14, 2026, as part of its July Patch Tuesday release. The flaw, tracked as CVE-2026-56190, carries a CVSS 3.1 score of 9.8 and does not require authentication or any action from a user to exploit (SentinelOne, 2026).
What happened
The vulnerability is a use of an uninitialized resource in the RDP server component, an issue Microsoft classifies under CWE-908 (SentinelOne, 2026). An attacker can send specially crafted RDP traffic to a system where Network Level Authentication, commonly called NLA, is turned off, and trigger memory corruption that can lead to arbitrary code execution (ServerGurus, 2026). No credentials, no user click, and no prior access to the target network are needed beyond the ability to reach the RDP listener.
The disclosure was part of a Patch Tuesday release Microsoft itself has described as its largest in a single month, covering 622 vulnerabilities across its product line, of which 63 were rated Critical (Tenable, 2026). Two vulnerabilities in that same batch were confirmed as already exploited in the wild; CVE-2026-56190 was not among them. As of July 16, 2026, public researchers had not reported confirmed exploitation, and Microsoft's own exploitability assessment for this specific CVE read "Exploitation Less Likely" (SentinelOne, 2026).
Who is affected
Windows systems from Windows 10 and 11 through Windows Server 2012 to 2025 are listed as affected where RDP is enabled (SentinelOne, 2026). Any organization running RDP-accessible Windows systems, whether on-premises, in a data center, or in a cloud environment, is in scope if NLA is not enforced. Given how widely RDP is deployed for remote administration, the exposed population is large even though initial exploitation activity has not been observed.
What affected parties should know
Enabling Network Level Authentication closes the specific pre-authentication path this vulnerability relies on, because NLA requires a user to authenticate before the vulnerable code path is reached (ServerGurus, 2026). That is not a substitute for patching. Researchers tracking the flaw have been consistent on this point: turn on NLA immediately as a free, fast mitigation, then apply Microsoft's July 2026 security update on the organization's normal emergency-patch cadence, because NLA reduces exposure but the underlying flaw remains present in unpatched code (ServerGurus, 2026; Zero Day Initiative, 2026).
Security teams should treat any internet-facing RDP endpoint as the highest priority for this patch, given the network attack vector and the absence of any authentication requirement.
What happens next
Microsoft's exploitability rating of "Exploitation Less Likely" is a snapshot, not a permanent judgment, and it has changed for other vulnerabilities within weeks of disclosure once public proof-of-concept code circulates. Organizations that have not yet enforced NLA or applied the July update should treat this as unresolved risk rather than a closed issue.
Sources
- SentinelOne, "CVE-2026-56190: Windows RDP RCE Vulnerability" - https://www.sentinelone.com/vulnerability-database/cve-2026-56190/
- ServerGurus, "CVE-2026-56190: Any Windows Server With RDP Exposed Can Be Taken Over. No Password Required." - https://servergurus.com/blog/cve-2026-56190-rdp-rce
- Zero Day Initiative, "The July 2026 Security Update Review" - https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review
- Tenable, "Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs, Including CVE-2026-56155 and CVE-2026-56164" - https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
- CrowdStrike, "July 2026 Patch Tuesday: Updates and Analysis" - https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-july-2026/