CVE-2026-32105: xrdp — Fix

Description

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.

Is your site exposed to CVE-2026-32105?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.7

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS — Exploit Prediction

0.0004

Probability of exploitation

0.14%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-354 CWE-354

Affected Products

Vendor	Product	Versions
neutrinolabs	xrdp	< 0.10.6

References

Advisories & Patches

https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3

Frequently Asked Questions

What is CVE-2026-32105? +

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity. It has a CVSS v3.1 base score of 7.7 (HIGH).

How severe is CVE-2026-32105? +

CVE-2026-32105 has a CVSS v3.1 score of 7.7 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0004, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-32105? +

CVE-2026-32105 affects products from neutrinolabs, specifically: xrdp. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-32105? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-12802

In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy …

CVE-2026-84900

Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities. HP has released HP …

CVE-2026-89320

`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the …

CVE-2026-58061

In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also …

CVE-2026-16001

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without …

CVE-2026-105280

Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix …

CVE-2026-32105