Critical severity9.3NVD Advisory· Published Sep 15, 2026· Updated Sep 24, 2026
CVE-2026-91949
CVE-2026-91949
Description
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8- osv-coords6 versionspkg:rpm/almalinux/freerdppkg:rpm/almalinux/freerdp-develpkg:rpm/almalinux/freerdp-libspkg:rpm/almalinux/freerdp-serverpkg:rpm/almalinux/libwinprpkg:rpm/almalinux/libwinpr-devel
< 2:3.10.3-12.el10_2.13+ 5 more
- (no CPE)range: < 2:3.10.3-12.el10_2.13
- (no CPE)range: < 2:3.10.3-12.el10_2.13
- (no CPE)range: < 2:3.10.3-12.el10_2.13
- (no CPE)range: < 2:3.10.3-12.el10_2.13
- (no CPE)range: < 2:3.10.3-12.el10_2.13
- (no CPE)range: < 2:3.10.3-12.el10_2.13
Patches
Vulnerability mechanics
References
2- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x7v6-xfx3-52j6nvdExploitMitigationVendor Advisory
- www.vulncheck.com/advisories/freerdp-3.0.0-through-3.30.0-protocol-negotiation-bypassnvdThird Party Advisory
News mentions
1- FreeRDP: 20 Vulnerabilities Disclosed, Including Critical RDSTLS BypassVypr Intelligence · Sep 15, 2026