This vulnerability involves insufficient UI warnings in Windows Remote Desktop on Windows 10 Version 1607 (build 10.0.14393.0). Due to this, an unauthorized attacker can perform spoofing attacks over a network by exploiting the lack of adequate user interface notifications for dangerous operations. The CVSS v3.1 base score is 7.1, reflecting high severity with network attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker can exploit the insufficient UI warning to spoof legitimate Remote Desktop sessions, potentially misleading users and causing unauthorized actions. The confidentiality impact is high, integrity impact is low, and availability impact is none. This could lead to unauthorized disclosure or misrepresentation in Remote Desktop connections.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151 to remediate this vulnerability.