CVE Alert: CVE-2026-121392 – FreeRDP

FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.

**Risk verdict:** This is a serious interception risk for exposed clients, but urgency cannot be fully ranked because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** A successful attack could expose session content and enable actions as the user, including credential theft or manipulation of remote activity. The attacker needs a trusted certificate and a position to intercept traffic, so this is not a routine remote compromise path, but the impact on targeted sessions is substantial.

**Most likely attack path:** The attacker positions themselves on the network path and presents a certificate that the client trusts but whose identity does not correctly match the intended server. No privileges or user action are required; high attack complexity and a required attack condition limit opportunity. Scope is unchanged, so direct impact is on the client’s session rather than a demonstrated foothold into connected systems.

**Who is most exposed:** Organisations using this client for remote administration or staff access are most at risk, particularly across untrusted networks or where certificate validation is not independently enforced.

Review RDP client logs for certificate name, SAN or identity-validation warnings.

Compare observed server certificate fingerprints with approved records.

Investigate unexpected proxy, VPN or network-path changes during RDP sessions.

Correlate unusual clipboard, file-transfer or authentication activity with affected sessions.

Mitigation and prioritisation

Upgrade to a vendor-fixed release; identify bundled copies as well as standalone installs.

Until updated, restrict RDP destinations and egress to approved hosts and trusted networks.

Enforce strict certificate identity checks through supported configuration or an approved gateway.

Confirm KEV, SSVC, PoC and EPSS status before finalising urgency; assess exposure and schedule changes accordingly.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.