CVE-2026-26151

CVE-2026-26151 is an insufficient UI warning vulnerability in Windows Remote Desktop that enables attackers to conduct spoofing attacks over a network by exploiting inadequate visual safeguards for dangerous operations. The vulnerability carries a CVSS score of 7.1 (HIGH) with a network-based attack vector requiring no privileges but involving user interaction, potentially resulting in high confidentiality impact and limited integrity compromise. Exploitation status indicators suggest minimal active threat, with an EPSS score of 0.00084 indicating this vulnerability ranks lower than approximately 99.76% of all CVEs in exploitation likelihood, and the CVE does not appear on the KEV catalog or active threat tracking lists, suggesting no current real-world exploitation activity or readily available public exploit code.