Microsoft RDP Vulnerability CVE-2024-21323 Lets Attackers Impersonate Servers

Key Takeaways

• Microsoft’s April 2026 Patch Tuesday update introduces new security dialogs for Windows Remote Desktop Connection (MSTSC).
• These dialogs aim to prevent phishing attacks that leverage malicious .rdp files to redirect user sessions to attacker-controlled infrastructure.
• The update implements a “secure by default” approach, requiring explicit user consent for local resource sharing and highlighting unsigned or unverified RDP files.
• The changes directly address a spoofing vulnerability reported by the UK’s NCSC and mitigate tactics used by groups like Midnight Blizzard.

Microsoft Bolsters RDP Security Against Phishing With New Warning Dialogs

Microsoft has rolled out significant security enhancements to its Windows Remote Desktop Connection (MSTSC) application as part of the April 2026 Patch Tuesday updates. These changes introduce critical warning dialogs designed to protect users from sophisticated phishing campaigns that exploit Remote Desktop Protocol (.rdp) files to compromise systems.

For some time, threat actors have increasingly weaponized .rdp files. These malicious files are often crafted to appear legitimate, tricking users into initiating connections that surreptitiously redirect their sessions to infrastructure controlled by attackers.

One prominent example involved the Russian state-sponsored threat group Midnight Blizzard. This group famously distributed malicious RDP files via large-scale spear-phishing emails. These files, while seemingly innocuous, silently requested access to sensitive local resources such as user drives, clipboards, and credential data, often before victims realized they had been compromised.

The United Kingdom’s National Cyber Security Center (NCSC) formally brought this vulnerability to Microsoft’s attention, reporting it as a spoofing flaw within Remote Desktop. This report directly led to the remediation efforts now deployed in the April 2026 update.

Enhanced User Prompts for RDP File Connections

Microsoft’s April 14, 2026, Patch Tuesday update (specifically KB5083769 for Windows 11 builds 26200.8246 and 26100.8246) introduces a two-tiered dialog system when a user attempts to open an .rdp file.

First-Time Educational Dialog

Upon opening an .rdp file for the very first time after the update, Windows will present an informational prompt. This dialog serves to educate users about the nature of RDP files and the inherent security risks they can pose. This educational message is a one-time occurrence per user account; once acknowledged and RDP file connections are permitted, it will not reappear unless Microsoft issues a future update to the dialog itself.

Per-Connection Security Dialog

Subsequent attempts to open an .rdp file will trigger a more detailed security warning dialog before any connection is established. This crucial prompt provides users with vital information, including the remote computer’s address, an indication of whether the file has been digitally signed by a verified publisher, and a comprehensive list of all local resource redirections requested by the file. These resources can include drives, clipboards, printers, smart cards, and WebAuthn credentials.

Crucially, all local resource redirect options are now disabled by default. Users must explicitly review and enable each individual item before proceeding with the connection, significantly reducing the risk of accidental or silent resource sharing.

In scenarios where an .rdp file lacks a digital signature or its publisher cannot be verified, the security dialog will prominently feature a “Caution: Unknown remote connection” banner, highlighted with an orange warning. The publisher field will display “Unknown publisher,” flagging this as the highest-risk scenario for potential tampering or phishing attempts. This directly addresses the common attack vector where threat actors distribute unsigned RDP files that users inadvertently open without scrutinizing their embedded connection parameters.

Secure by Default Design Philosophy

This update reflects a fundamental shift towards a “secure by default” design philosophy. Previously, users received no warnings when opening an RDP file, allowing malicious files to silently request broad local access. With the April 2026 update, unsafe resource sharing is no longer an inherited default from the file but requires active, explicit user consent.

For administrators who may need to temporarily revert to the legacy dialog behavior, this can be achieved by modifying the RedirectionWarningDialogVersion registry value under HKLMSoftwarePoliciesMicrosoftWindows NTTerminal ServicesClient and setting it to 1. However, this is strongly discouraged as a long-term solution due to the associated security risks.

What You Should Do

• Apply Updates Immediately: Ensure all Windows systems are updated with the April 2026 Patch Tuesday security updates (KB5083769 for Windows 11 builds 26200.8246 and 26100.8246) to implement these new protections.
• Educate Users: Inform users about the new RDP warning dialogs and the importance of scrutinizing connection details, especially for unsigned or unknown RDP files. Emphasize the need to explicitly enable resource sharing only when absolutely necessary and from trusted sources.
• Review RDP File Practices: Organizations should review their internal RDP file distribution and usage policies. Prioritize and standardize the use of digitally signed .rdp connection files to establish trust and reduce the risk of “trusted attachment” abuse.
• Avoid Unsigned RDP Files: Instruct users to be highly suspicious of and avoid opening .rdp files from unknown or unverified sources, especially those that trigger the “Caution: Unknown remote connection” warning.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.