This vulnerability (CVE-2026-26151) is classified under CWE-357, indicating insufficient UI warnings of dangerous operations. Specifically, in Windows Remote Desktop on Windows 10 Version 1607 (build 10.0.14393.0), the UI does not adequately warn users about potentially dangerous operations, enabling an unauthorized attacker to conduct spoofing attacks over a network. The CVSS v3.1 base score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Microsoft has issued an official fix for this vulnerability, as documented in their security update guide.

An attacker can exploit this vulnerability to perform spoofing attacks over a network, potentially deceiving users by presenting misleading UI elements related to Windows Remote Desktop operations. This could lead to unauthorized disclosure of information (high confidentiality impact) but has limited impact on integrity and no impact on availability. The vulnerability requires user interaction but no privileges or complex attack conditions.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as soon as possible to remediate this issue. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151 for the official patch and update instructions.