CVE-2026-56190 lets an attacker run code on a Windows machine over Remote Desktop with no login and no clicks. It's the same profile as BlueKeep — the RDP bug that became a worm. It isn't exploited yet. 'Yet' is the word to act on.
Anyone who was doing security in 2019 just felt a chill, because CVE-2026-56190 has the exact shape of BlueKeep — the Windows Remote Desktop bug so dangerous that Microsoft took the rare step of patching end-of-life Windows XP, and that went on to power self-spreading worms. This new flaw is a 9.8, it's in RDP, and a remote attacker can trigger it with no login and no user interaction — just network access to the Remote Desktop service. The one piece of good news is that, as of now, it isn't being exploited in the wild. For a wormable-class RDP RCE, that's not reassurance. That's a countdown.
0.0/ 10
CVSS severity: Critical
Unauthenticated, network-based RCE with no user interaction — the profile that historically becomes wormable.
Why 'RDP' plus '9.8' plus 'unauthenticated' is the scary combination
Remote Desktop is how administrators log into Windows machines remotely, which means the service is, by design, listening for network connections — and it's exposed on an enormous number of machines, including far too many that face the open internet directly. An unauthenticated RCE in that service is a worst case: an attacker doesn't need a password, doesn't need you to click anything, doesn't need any foothold — they need only to be able to reach the RDP port. That's precisely what made BlueKeep (CVE-2019-0708) so feared, and why it produced worms that spread machine to machine without human help. The technical class here is different — a use of uninitialized memory rather than BlueKeep's use-after-free — but the exploitation profile is the same, and that profile is the whole story.
Why this class of bug spreads
Reach the RDP port
Any machine that can connect to the Remote Desktop service — no credentials needed.
Trigger the bug
A crafted connection exploits the uninitialized-resource flaw (CWE-908).
Code execution
The attacker runs code on the target with no authentication.
Spread
The compromised machine scans for and hits the next exposed RDP — worm behaviour.
Reach the RDP port
Any machine that can connect to the Remote Desktop service — no credentials needed.
Trigger the bug
A crafted connection exploits the uninitialized-resource flaw (CWE-908).
Code execution
The attacker runs code on the target with no authentication.
Spread
The compromised machine scans for and hits the next exposed RDP — worm behaviour.
No password, no click, no foothold. A compromised machine can reach the next one's RDP port — which is how RDP bugs become worms.
The NVD entry: 9.8 CRITICAL, 'use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.' · NIST National Vulnerability Database (screenshot)
What to do
Patch, and while you're at it, fix the exposure that makes RDP bugs catastrophic in the first place. The single biggest risk multiplier for any RDP vulnerability is having Remote Desktop reachable from the internet — it never should be. Put it behind a VPN or a Remote Desktop Gateway, require Network Level Authentication (which forces authentication before the vulnerable code path is reached, blunting many RDP exploits), and lock down which networks can reach the port. Do those things and the next RDP 9.8 — because there's always a next one — is a patch you apply calmly rather than an emergency.
Apply the July 2026 security update across Windows 10, 11 and Server 2012–2025 — every supported version is affected.
Get RDP off the public internet: put it behind a VPN or RD Gateway. An internet-facing RDP port is the risk that turns a CVE into a breach.
Enable Network Level Authentication (NLA) — it requires auth before the vulnerable code runs, mitigating many RDP exploits even pre-patch.
Restrict RDP access to specific trusted management networks, and watch for scanning of TCP 3389.
Quick answers
Is CVE-2026-56190 being exploited yet?
Not as of mid-July, per CISA — there's no confirmed in-the-wild exploitation at the time of writing. But it's an unauthenticated 9.8 in RDP, which is the profile attackers race to weaponise, and exploit development for high-value RDP bugs is historically fast. Treat 'not yet' as a window to patch in, not a reason to wait. The whole point of BlueKeep's lesson is that you patch these before the exploitation wave, not during it.
Which systems are affected?
Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, on both 32- and 64-bit. That's essentially every supported Windows version running the Remote Desktop service. If a machine has RDP enabled — and many do, often without the admin realising — it needs the July update.
Does Network Level Authentication protect me?
It helps significantly but isn't a substitute for patching. NLA requires a user to authenticate before a full RDP session is established, which means an unauthenticated attacker can't reach the vulnerable code path as easily. For many RDP exploits that's an effective mitigation. But enable it as defence-in-depth alongside the patch, not instead of it — patch first, then keep NLA on permanently.
How is this like BlueKeep?
Same service (RDP), same exploitation profile: unauthenticated, network-based, no user interaction, and 'wormable' — meaning a single compromised machine could automatically spread to others. BlueKeep (CVE-2019-0708) was a use-after-free; this is an uninitialized-resource bug, so the internals differ. What matters for you is identical: it's the class of RDP flaw that has historically led to self-propagating attacks, which is why it deserves urgent patching.
Primary detail is on the NVD entry and Microsoft's advisory; Rapid7's Patch Tuesday roundup has the wider July context. The lesson RDP keeps teaching: the service you use to manage machines remotely is the one you can least afford to leave exposed or unpatched. Patch this, get RDP off the internet, and if you're catching up on the month's other criticals, the DHCP Server RCE and Ivanti Sentry perfect-10 are the other appliance and infrastructure bugs worth the same urgency.
