CVE-2026-33145

CVE-2026-33145 is a remote command execution vulnerability affecting xrdp, an open-source RDP server, in versions through 0.10.6. The flaw exists in the handling of the AlternateShell parameter within xrdp-sesman, where user-supplied values are executed unsanitized via /bin/sh -c when the AllowAlternateShell setting is enabled, which is the default configuration. This allows authenticated remote users to execute arbitrary commands in the context of the authenticated user prior to normal session initialization. The vulnerability carries a CVSS 3.1 score of 6.3 (Medium severity) with a network attack vector, low complexity, and low privilege requirements. The impact is limited to confidentiality, integrity, and availability on the targeted system. While the attack requires authentication, the absence of user interaction and the ability to bypass expected session initialization flows create meaningful operational risk in environments where RDP access is granted to untrusted or guest accounts. Exploitation activity appears minimal at present. The vulnerability is not currently tracked on the Known Exploited Vulnerabilities catalog, has no identified public exploit code in active circulation, and maintains an inactive status on exploit availability hot lists. However, given the straightforward nature of the vulnerability and the simplicity of exploitation for authenticated users, organizations should prioritize patching to version 0.10.6 or later to prevent potential future exploitation.