CVE-2026-91949: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-09-15 · updated 2026-09-24
Weakness: CWE-693

Description

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Affected products

FreeRDP: from 3.0.0 before 3.31.0 — fixed in 3.31.0

How to fix

Upgrade to a fixed version: FreeRDP 3.31.0. Check the vendor advisory for mitigations.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6
https://www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypass

Get alerted when CVE-2026-91949 or the next vulnerability affects your stack