Skip to content
Fencer Vulns
high 7.5

CVE-2026-18358 json

Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

published 2026-07-31 3 mo ago modified 2026-11-05 3 d ago also EUVD-2026-51528

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:49.3-4.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:47.3-3.el10_0.1
  • gnome-remote-desktop RHEL 10.2 49.3-4.el10_2

red hat advisories RHSA-2026:54512

  • gnome-remote-desktop openSUSE Leap 16.0 48.3-160000.3.1

opensuse advisories openSUSE-SU-2026:21888-1

  • gnome-remote-desktop AlmaLinux 10 49.3-4.el10_2

almalinux advisories ALSA-2026:54512

  • gnome-remote-desktop Rocky Linux 10 49.3-4.el10_2

rocky linux advisories RLSA-2026:54512

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-18358 updated cvss 7.5

gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service

  • Red Hat Enterprise Linux AppStream (v. 10) gnome-remote-desktop 49.3-4.el10_2
    fixed: vendor fix “If system-mode RDP is not required, disable it. If it must remain enabled, restrict the RDP listener (default port 3389) to trusted hosts or management networks using host-based firewall rules.” RHSA-2026:54512
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gnome-remote-desktop 47.3-3.el10_0.1
    fixed: vendor fix “If system-mode RDP is not required, disable it. If it must remain enabled, restrict the RDP listener (default port 3389) to trusted hosts or management networks using host-based firewall rules.” RHSA-2026:86194
  • Red Hat Enterprise Linux 8 gnome-remote-desktop Red Hat Enterprise Linux 9 gnome-remote-desktop
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • GNOME gnome-remote-desktop
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.