CVE-2024-49120
Windows Remote Desktop Services Remote Code Execution Vulnerability
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- EPSS probability
- 1.08%
- CWE
- CWE-453
- Published
- 2024-12-10
- Last modified
- 2026-06-09
Affected products
- Microsoft Windows Server 2019
- Microsoft Windows Server 2019 (Server Core installation)
- Microsoft Windows Server 2022
- Microsoft Windows Server 2025 (Server Core installation)
- Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
- Microsoft Windows Server 2025
- Microsoft Windows Server 2016
- Microsoft Windows Server 2016 (Server Core installation)
Weakness type
Related vulnerabilities
- CVE-2026-19212 — WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable
- CVE-2026-41330 — OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy
- CVE-2025-61926 — Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret
- CVE-2025-47945 — Donetick Has Weak Default JWT Secret
- CVE-2025-30206 — Dpanel's hard-coded JWT secret leads to remote code execution
- CVE-2024-39916 — NFS server misconfiguration allows file access outside the exported directory
- CVE-2024-21411 — Skype for Consumer Remote Code Execution Vulnerability
- CVE-2023-27516 — An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN...