What’s Vulnerable › Vulnerabilities

CVE-2026-96541: Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-23 · updated 2026-10-14
• Weakness: CWE-400

Description

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-96541
• https://bugzilla.redhat.com/show_bug.cgi?id=2539385
• https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/356
• https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/356

Get alerted when CVE-2026-96541 or the next vulnerability affects your stack