CVE-2026-32107
Neutrinolabs Xrdp ≤ 0.10.6
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-32107 is a high-severity Improper Check for Dropped Privileges (CWE-273) vulnerability in Neutrinolabs Xrdp. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32107 affects xrdp, an open source Remote Desktop Protocol (RDP) server, specifically in versions through 0.10.5. The vulnerability resides in the session execution component, which fails to properly handle an error during the privilege drop process. This constitutes improper privilege management (CWE-273), enabling potential privilege escalation. The issue has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its local attack vector, low complexity, and comprehensive impact on confidentiality, integrity, and availability in a changed scope.
An authenticated local attacker could exploit this flaw to escalate privileges to root and execute arbitrary code on the affected system. Exploitation requires initial local access with low privileges and an additional exploit to facilitate the privilege drop failure, after which the mishandled error allows the attacker to bypass intended restrictions.
The xrdp project has addressed this vulnerability in version 0.10.6, as detailed in the release notes and security advisory. Security practitioners should upgrade to v0.10.6 or later to mitigate the risk, with further details available in the GitHub release at https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 and the advisory at https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23474
Vulnerability Data
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to…
more
root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employing least privilege requires that privilege-dropping operations succeed and are verified before continuing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC activities (code review, static analysis, testing) catch missing or incorrect privilege-drop checks, but eliminating only this one flaw covers only a fraction of the control's broader intent.
Least-privilege policy and enforcement directly motivate privilege-dropping code, yet the control does not address implementation-level verification of the drop.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect failed privilege drops, yet the control does not require such checks as part of its core intent.
Control of privileged utility programs includes ensuring privilege-dropping operations are verified before use.
Privileged access rights policy requires verification that privilege changes succeed, directly addressing failed privilege drops.
Secure coding practices can prevent missing privilege-drop checks, but the control itself does not mandate verification of privilege changes.