Pre-authentication flaws

RDP's pre-session protocol handling has produced wormable, unauthenticated remote code execution vulnerabilities, the BlueKeep and DejaBlue class, reachable before login on hosts without Network Level Authentication. Fingerprinting the Windows build and NLA status identifies hosts in the affected range, where exploitation gives SYSTEM with no credentials.

1 phút đọccập nhật 5 thg 10, 2026

1 người đóng góp

The most severe RDP vulnerabilities are pre-authentication: memory-corruption bugs in the protocol handling that runs before a user logs in, reachable by an unauthenticated client and giving code execution as SYSTEM. Because RDP is so widely exposed, these are wormable, capable of self-propagating across networks, which is why they drew urgent, out-of-cycle patches and comparisons to the SMB worm events. They live in the pre-session code, so Network Level Authentication (which forces authentication first) blocks reaching them; an NLA-off host of the right build is exposed. The two named classes are BlueKeep and DejaBlue.

bash

# collect build information when CredSSP responds and enumerate accepted security layers
nmap -p3389 --script rdp-ntlm-info,rdp-enum-encryption <target>
# interpret the complete output: CredSSP support does not prove that NLA is required
nmap -p3389 --script rdp-vuln-ms12-020 <target>                   # (older RDP DoS/vuln check)

Subtopics#

BlueKeep: the pre-auth RCE in the pre-NLA RDP code path.
DejaBlue: the follow-on pre-auth RCE class affecting newer builds.

Pre-authentication flaws

Subtopics#

References#