CVE-2026-72746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72746", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "REJECTED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T13:53:42.482Z", "datePublished": "2026-08-11T12:17:00.687Z", "dateUpdated": "2026-08-12T16:58:13.054Z", "dateRejected": "2026-08-12T16:58:13.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-12T16:58:13.054Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.<br>"}]}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72746", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "REJECTED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T13:53:42.482Z", "datePublished": "2026-08-11T12:17:00.687Z", "dateUpdated": "2026-08-12T16:58:13.054Z", "dateRejected": "2026-08-12T16:58:13.054Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-12T16:58:13.054Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241.<br>"}]}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-73241."}], "id": "CVE-2026-72746", "lastModified": "2026-08-12T17:17:31.793", "metrics": {}, "published": "2026-08-11T13:19:05.520", "references": [], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "FreeRDP: FreeRDP: Authentication bypass in RDSTLS handshake via PDU-type confusion", "id": "2513945", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513945"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-1287", "details": ["A flaw was found in FreeRDP. An unauthenticated remote attacker could bypass the server-side authentication in the RDSTLS (Remote Desktop Services Transport Layer Security) handshake. By sending a Capabilities PDU instead of the expected Authentication Request PDU, the server incorrectly processes the request, leading to a successful authentication without validating any credentials. This allows the attacker to gain unauthorized access to a session."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that FreeRDP servers are not configured with `RdstlsSecurity = TRUE` unless explicitly required. If `RdstlsSecurity` is necessary, restrict network access to the FreeRDP server to trusted clients only, for example, by implementing firewall rules. Restarting the FreeRDP server may be required for configuration changes to take effect."}, "name": "CVE-2026-72746", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-11T12:17:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72746\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72746\nhttps://github.com/FreeRDP/FreeRDP/commit/b05a9510787c83c87ffc5fa8d7cc9f06ed971695\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rqgv-grx4-xm6x\nhttps://www.vulncheck.com/advisories/freerdp-before-rdstls-server-authentication-bypass-via-pdu-type-confusion"], "statement": "This is an Important flaw where FreeRDP servers configured with RDSTLS security are vulnerable to an authentication bypass. An unauthenticated remote attacker can exploit a PDU-type confusion during the handshake to gain unauthorized access, circumventing credential checks. This poses a significant risk to the confidentiality of systems exposing FreeRDP with RDSTLS enabled.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.30.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeRDP", "source": "cna", "vendor": "FreeRDP"}, "product": "freerdp", "vendor": "freerdp"}], "created": "2026-08-11T23:45:04.588955+00:00", "updated": "2026-08-12T00:00:03.980301+00:00", "vendors": ["freerdp", "freerdp$PRODUCT$freerdp"]}