Microsoft Windows RDP can bypass the Windows lock screen

published 2020-01-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-18884

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.4%; EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits: 0; none known

A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a temporary RDP disconnect, Automatic Reconnection of the RDP session will be restored to an unlocked state, regardless of how the remote system was left. By interrupting network connectivity of a system, an attacker with access to a system being used as a Windows RDP client can gain access to a connected remote system, regardless of whether or not the remote system was locked. This issue affects Microsoft Windows 10, version 1803 and later, and Microsoft Windows Server 2019, version 2019 and later.

Patch / fix

links 2

Exploit prediction

1.42% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.6	AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

Microsoft Windows 10 or newer system using RDP
Microsoft Windows Server

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-755 Improper Handling of Exceptional Conditions

References

docs.microsoft.com /en-us/openspecs/windows_protocols/ms-rdpbcgr/e729948a-3f4e-4568-9aef-d355e30b5389
patch, vendor-advisory
social.technet.microsoft.com /Forums/windowsserver/en-US/1fd171de-a1b5-4721-86bf-082e4a375049/rds-2019-but-probably-other-versions-as-well-
patch, vendor-advisory
kb.cert.org /vuls/id/576688/
third-party-advisory, us-government-resource
docs.microsoft.com /en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732713%28v=ws.11%29

Sources

CVE List CVE-2019-9510
NVD CVE-2019-9510

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary