This vulnerability (CVE-2026-26151) affects Windows 10 Version 1607 (build 10.0.14393.0) and involves insufficient UI warnings for dangerous operations in the Remote Desktop feature. The lack of adequate warnings can enable an unauthorized attacker to conduct spoofing attacks over a network, potentially deceiving users about the legitimacy of remote connections. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality impact with limited integrity impact. Microsoft has published an official fix to address this issue.

An attacker can exploit this vulnerability to perform spoofing attacks over a network by exploiting insufficient UI warnings in Windows Remote Desktop. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) but has limited impact on integrity and no impact on availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft to remediate this vulnerability. Users and administrators should apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26151. No additional mitigation actions are indicated by the vendor advisory.