CVE-2026-26151
Published: 14 April 2026
Summary
CVE-2026-26151 is a high-severity Insufficient UI Warning of Dangerous Operations (CWE-357) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique GUI Input Capture (T1056.002); ranked in the top 47.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-17 (Remote Access).
Deeper analysis
CVE-2026-26151 is a vulnerability in Windows Remote Desktop stemming from insufficient UI warnings for dangerous operations, which allows an unauthorized attacker to perform spoofing over a network. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and maps to CWE-357.
The attack requires no privileges and can be launched over the network with low complexity, though it demands user interaction. Successful exploitation enables high-impact confidentiality violations alongside low-impact integrity alterations, such as spoofing to trick users into disclosing sensitive information.
For mitigation guidance and patch details, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22372
Vulnerability details
Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables UI-based spoofing in RDP to trick users into disclosing sensitive data via insufficient warnings (maps to GUI Input Capture and Impersonation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the insufficient UI warnings vulnerability in Windows Remote Desktop through timely application of vendor patches from the Microsoft Security Response Center advisory.
Manages and authorizes remote access to limit network-based spoofing attacks exploiting Remote Desktop's UI deficiencies.
Protects the authenticity of Remote Desktop communications sessions to mitigate unauthorized spoofing that relies on inadequate UI warnings for dangerous operations.