Microsoft Confirms Remote Desktop Warnings May Display Incorrectly After April 2026 Security Update

Key Takeaways

• Microsoft has acknowledged a display issue affecting Remote Desktop Protocol (RDP) security warnings.
• The problem occurs on Windows 11 systems running specific April 2026 cumulative updates, particularly with multi-monitor setups using varying display scaling.
• This bug hinders users from properly viewing and interacting with critical security prompts designed to protect against RDP spoofing (CVE-2026-26151).
• While a fix is pending, Microsoft advises administrators to monitor affected workstations.

Microsoft Confirms Remote Desktop Warnings May Display Incorrectly After April 2026 Security Update

Microsoft has officially confirmed a significant display anomaly impacting Remote Desktop Protocol (RDP) security warning dialogues following its April 2026 cumulative updates for Windows 11. This flaw, which causes warnings to render improperly, raises considerable usability concerns, especially given the crucial role these prompts play in safeguarding users from potential phishing attacks.

Origin of the Bug and Affected Systems

The issue emerged with the April 14, 2026, Patch Tuesday security updates. Specifically, the problem is linked to KB5083769 for Windows 11 versions 25H2 and 24H2, and KB5083768 for Windows 11 version 26H1. These updates were intended to bolster RDP security by introducing more robust warning mechanisms.

The new RDP security warnings were implemented as part of Microsoft’s ongoing efforts to mitigate CVE-2026-26151, a Remote Desktop spoofing vulnerability that had been actively exploited in the wild. The design goal was to present users with a clear, comprehensive warning dialog prior to any RDP connection, detailing publisher verification status, the remote computer’s address, and options for local resource access.

However, almost immediately following the update’s release, users began reporting rendering glitches with these new dialogs. This prompted Microsoft to formally acknowledge the issue as a known issue on April 23, 2026, with subsequent documentation corrections made on April 27, 2026.

Impact on Security Warnings

According to Microsoft’s support documentation, the problem specifically affects systems configured with multiple monitors using different display scaling settings. For example, if one monitor is set to 100% scaling and another to 125%, the RDP warning window may display overlapping text or obscure crucial buttons. This makes it challenging, if not impossible, for users to accurately read and interact with the essential security prompt.

This rendering defect is particularly concerning because the warning dialog serves as a critical trust checkpoint. Users are expected to review this prompt before granting a remote machine access to local resources such as clipboards, smart cards, printers, and cameras. The underlying RDP warnings were initially introduced to counteract sophisticated phishing campaigns that leverage weaponized .rdp files. In these attacks, threat actors distribute malicious RDP configuration files to silently hijack credentials or redirect sensitive local resources without explicit user consent.

The April 2026 updates also included a change to disable local resource redirection by default for pre-configured RDP files, requiring explicit user acknowledgment for each connection. This change underscores the importance of the warning dialog’s proper functionality.

Microsoft has indicated that a permanent resolution will be delivered in a forthcoming cumulative update. In the interim, enterprise administrators are advised to closely monitor workstations utilizing mixed-DPI display configurations.

What You Should Do

• Monitor Workstations: Keep a close watch on Windows 11 systems, especially those with multi-monitor setups using varying display scaling settings, to identify instances of incorrectly rendered RDP warning dialogs.
• Educate Users: Remind users about the importance of verifying RDP connection details even if the warning dialog appears visually distorted. Advise them to exercise extreme caution before proceeding with any remote connection.
• Prioritize Updates: Stay informed about upcoming Microsoft cumulative updates and apply them promptly once available, as a permanent fix for this issue is expected in a future release.
• Review RDP Policies: Ensure that your organization’s RDP policies are robust, particularly regarding local resource redirection, to minimize potential attack surfaces.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.