A critical flaw in FreeRDP 3.x server builds before 3.31.0 allows unauthenticated attackers to negotiate RDSTLS connections even when server policy explicitly disables them.
What Is It
CVE-2026-91949 is a protocol negotiation bypass in the FreeRDP server implementation. Per the CVE record published in NVD, FreeRDP server versions 3.0.0 through 3.30.0 permit unauthenticated attackers to establish RDSTLS connections despite server policy disabling that transport.
The attack sequence is straightforward: the attacker sends incompatible protocol requests, receives a negotiation failure from the server, then completes the TLS handshake anyway and enters RDSTLS, bypassing the pre-authentication transport restrictions the operator configured.
The flaw is classified as CWE-693 (Protection Mechanism Failure), which matches the behavior precisely: the security control exists, but it can be walked around.
Why It Matters
The issue carries a CVSS 3.1 base score of 9.3 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. A secondary CVSS 4.0 assessment from the reporting source rates it 9.2, also Critical.
The exploitability characteristics are the concerning part. Attack vector is network, attack complexity is low, and neither privileges nor user interaction are required; this is reachable by anyone who can talk to the listening RDP service. Scope is marked Changed, meaning the impact reaches resources beyond the vulnerable component itself, with High confidentiality impact, Low integrity impact, and no availability impact.
Practically, an administrator who disabled RDSTLS as a hardening decision does not actually get that restriction enforced. The pre-authentication attack surface they intended to close stays open.
CVE-2026-91949 does not appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-09-15, so there is no confirmed active exploitation and no federal remediation deadline at this time.
What's Vulnerable
Per the vendor-supplied affected-version data:
- Vendor/Product: FreeRDP
- Affected: versions 3.0.0 up to (but not including) 3.31.0; server-side
- Unaffected: 3.31.0 and later
No CPE match strings were published in the NVD record, so asset inventory tooling keyed on CPE may not flag affected hosts yet. Version-based identification is the reliable path right now.
Patch Status
Fixed in FreeRDP 3.31.0. Operators running any FreeRDP server in the 3.0.0–3.30.0 range should upgrade to 3.31.0 or later. The record was published 2026-09-15 and currently sits in NVD status "Received," meaning NVD has not performed its own analysis yet; the severity scoring and weakness mapping above come from the CNA, and the record may be enriched or revised as analysis completes.