PT-2026-33487 · Xrdp · Xrdp

Exploitintel · Published 2026-04-17 · Updated 2026-05-19 · CVE-2026-32105

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6

Description xrdp fails to implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when the Classic RDP Security layer is used. Although signatures are generated by the sender, the receiving logic ignores the 8-byte integrity signature. This allows an unauthenticated attacker with man-in-the-middle (MITM) capabilities to modify encrypted traffic in transit without detection. This issue does not affect connections where the TLS security layer is enforced.

Recommendations Update to version 0.10.6. Configure xrdp.ini to enforce TLS security by setting security layer=tls to ensure end-to-end integrity.

Fix

LPE

DoS

RCE

Weakness Enumeration

CWE-354

Related Identifiers

BDU:2026-06985

CVE-2026-32105

OPENSUSE-SU-2026:10816-1

Affected Products

Xrdp

References · 21

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3 · Vendor Advisory
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 · Patch
• https://cve.org/CVERecord?id=CVE-2026-32105 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10816-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32105 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32105 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32105 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32105 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06985 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32105 · Security Note
• https://suse.com/security/cve/CVE-2026-33689 · Note
• https://twitter.com/threatcluster/status/2049026029822378015 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32107 · Note
• https://suse.com/security/cve/CVE-2026-32623 · Note
• https://suse.com/security/cve/CVE-2026-35512 · Note