CVE-2022-21990

mediumpriority · track · 34EPSS 0.188 · 97 %ileDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

18.8% (97th) EPSS

CVSS 6.8 · medium

Is it mine?

178 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · pepperl_fuchs_psirt

EPSS · scored 2026-10-27

Remote Desktop Client Remote Code Execution Vulnerability

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpepperl_fuchs_psirt
Mitigation The following external protective measured are required: Connect only to trusted RDP servers. Protect your RDP servers with anti-virus software and Intrusion Detection System(=IDS) Access control to RDP servers and the role administrator and engineer on theaffected device. UPDATE ASolution Install the following firmware with security patches to fix this vulnerability.For products with Windows 10 LTSB 2016:RM Image 5 Windows Cumulative Security Patch 03/2022 (KB5011495) incl. 2021-09 Servicing Stack Update (KB5005698) incl. Microsoft .NET Framework 4.7.2 for x64 (KB4054590) Link: https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-33624 For products with Windows 10 LTSC 2019:RM Image 5.5 Windows Cumulative Security Patch for LTSC 03/2022 (KB5011503) incl. 08/2021 Servicing Stack Update (KB5005112) Link: https://www.pepperl-fuchs.com/cgi-bin/db/doci.pl/?ShowDocByDocNo=18-34182 Please note that the links provided are managed and point to the latest firmware availablefor VisuNet devices.END UPDATE A
FixedRemote Desktop client for Windows Desktopmsrc_csaf
1.2.2925.0:Security Update:https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windowsdesktop-whatsnew
https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windowsdesktop-whatsnew
FixedWindows 10 Version 1607 for 32-bit Systemsmsrc_csaf
10.0.14393.5006:Security Update:https://support.microsoft.com/help/5011495
https://support.microsoft.com/help/5011495
FixedWindows 10 Version 1607 for x64-based Systemsmsrc_csaf
10.0.14393.5006:Security Update:https://support.microsoft.com/help/5011495
https://support.microsoft.com/help/5011495
FixedWindows 10 Version 1809 for 32-bit Systemsmsrc_csaf
10.0.17763.2686:Security Update:https://support.microsoft.com/help/5011503
https://support.microsoft.com/help/5011503
FixedWindows 10 Version 1809 for ARM64-based Systemsmsrc_csaf
10.0.17763.2686:Security Update:https://support.microsoft.com/help/5011503
https://support.microsoft.com/help/5011503
FixedWindows 10 Version 1809 for x64-based Systemsmsrc_csaf
10.0.17763.2686:Security Update:https://support.microsoft.com/help/5011503
https://support.microsoft.com/help/5011503
FixedWindows 10 Version 1909 for 32-bit Systemsmsrc_csaf
10.0.18363.2158:Security Update:https://support.microsoft.com/help/5011485
https://support.microsoft.com/help/5011485
FixedWindows 10 Version 1909 for ARM64-based Systemsmsrc_csaf
10.0.18363.2158:Security Update:https://support.microsoft.com/help/5011485
https://support.microsoft.com/help/5011485
FixedWindows 10 Version 1909 for x64-based Systemsmsrc_csaf
10.0.18363.2158:Security Update:https://support.microsoft.com/help/5011485
https://support.microsoft.com/help/5011485
FixedWindows 10 Version 20H2 for 32-bit Systemsmsrc_csaf
10.0.19042.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 20H2 for ARM64-based Systemsmsrc_csaf
10.0.19042.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H1 for 32-bit Systemsmsrc_csaf
10.0.19043.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H1 for ARM64-based Systemsmsrc_csaf
10.0.19043.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H1 for x64-based Systemsmsrc_csaf
10.0.19043.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H2 for 32-bit Systemsmsrc_csaf
10.0.19044.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H2 for ARM64-based Systemsmsrc_csaf
10.0.19044.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 Version 21H2 for x64-based Systemsmsrc_csaf
10.0.19044.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
FixedWindows 10 for 32-bit Systemsmsrc_csaf
10.0.10240.19235:Security Update:https://support.microsoft.com/help/5011491
https://support.microsoft.com/help/5011491
FixedWindows 10 for x64-based Systemsmsrc_csaf
10.0.10240.19235:Security Update:https://support.microsoft.com/help/5011491
https://support.microsoft.com/help/5011491
FixedWindows 11 version 21H2 for ARM64-based Systemsmsrc_csaf
10.0.22000.556:Security Update:https://support.microsoft.com/help/5011493
https://support.microsoft.com/help/5011493
FixedWindows 11 version 21H2 for x64-based Systemsmsrc_csaf
10.0.22000.556:Security Update:https://support.microsoft.com/help/5011493
https://support.microsoft.com/help/5011493
FixedWindows 7 for 32-bit Systems Service Pack 1msrc_csaf
6.1.7601.25898:Security Only:https://support.microsoft.com/help/5011529
https://support.microsoft.com/help/5011529
FixedWindows 7 for x64-based Systems Service Pack 1msrc_csaf
6.1.7601.25898:Security Only:https://support.microsoft.com/help/5011529
https://support.microsoft.com/help/5011529
FixedWindows 8.1 for 32-bit systemsmsrc_csaf
6.3.9600.20303:Security Only:https://support.microsoft.com/help/5011560
https://support.microsoft.com/help/5011560
FixedWindows 8.1 for x64-based systemsmsrc_csaf
6.3.9600.20303:Security Only:https://support.microsoft.com/help/5011560
https://support.microsoft.com/help/5011560
FixedWindows RT 8.1msrc_csaf
6.3.9600.20296:Monthly Rollup:https://support.microsoft.com/help/5010419
https://support.microsoft.com/help/5010419
FixedWindows Server 2008 R2 for x64-based Systems Service Pack 1msrc_csaf
6.1.7601.25898:Security Only:https://support.microsoft.com/help/5011529
https://support.microsoft.com/help/5011529
FixedWindows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)msrc_csaf
6.1.7601.25898:Security Only:https://support.microsoft.com/help/5011529
https://support.microsoft.com/help/5011529
FixedWindows Server 2008 for 32-bit Systems Service Pack 2msrc_csaf
6.0.6003.21416:Security Only:https://support.microsoft.com/help/5011525
https://support.microsoft.com/help/5011525
FixedWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)msrc_csaf
6.0.6003.21416:Security Only:https://support.microsoft.com/help/5011525
https://support.microsoft.com/help/5011525
FixedWindows Server 2008 for x64-based Systems Service Pack 2msrc_csaf
6.0.6003.21416:Security Only:https://support.microsoft.com/help/5011525
https://support.microsoft.com/help/5011525
FixedWindows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)msrc_csaf
6.0.6003.21416:Security Only:https://support.microsoft.com/help/5011525
https://support.microsoft.com/help/5011525
FixedWindows Server 2012msrc_csaf
6.2.9200.23639:Security Only:https://support.microsoft.com/help/5011527
https://support.microsoft.com/help/5011527
FixedWindows Server 2012 (Server Core installation)msrc_csaf
6.2.9200.23639:Security Only:https://support.microsoft.com/help/5011527
https://support.microsoft.com/help/5011527
FixedWindows Server 2012 R2msrc_csaf
6.3.9600.20303:Security Only:https://support.microsoft.com/help/5011560
https://support.microsoft.com/help/5011560
FixedWindows Server 2012 R2 (Server Core installation)msrc_csaf
6.3.9600.20303:Security Only:https://support.microsoft.com/help/5011560
https://support.microsoft.com/help/5011560
FixedWindows Server 2016msrc_csaf
10.0.14393.5006:Security Update:https://support.microsoft.com/help/5011495
https://support.microsoft.com/help/5011495
FixedWindows Server 2016 (Server Core installation)msrc_csaf
10.0.14393.5006:Security Update:https://support.microsoft.com/help/5011495
https://support.microsoft.com/help/5011495
FixedWindows Server 2019msrc_csaf
10.0.17763.2686:Security Update:https://support.microsoft.com/help/5011503
https://support.microsoft.com/help/5011503
FixedWindows Server 2019 (Server Core installation)msrc_csaf
10.0.17763.2686:Security Update:https://support.microsoft.com/help/5011503
https://support.microsoft.com/help/5011503
FixedWindows Server 2022msrc_csaf
10.0.20348.587:Security Update:https://support.microsoft.com/help/5011497
https://support.microsoft.com/help/5011497
FixedWindows Server 2022 (Server Core installation)msrc_csaf
10.0.20348.587:Security Update:https://support.microsoft.com/help/5011497
https://support.microsoft.com/help/5011497
FixedWindows Server, version 20H2 (Server Core Installation)msrc_csaf
10.0.19042.1586:Security Update:https://support.microsoft.com/help/5011487
https://support.microsoft.com/help/5011487
Mitigationpepperl_fuchs_psirt
The following external protective measured are required: - Connect only to trusted RDP servers. - Protect your RDP servers with anti-virus software and Intrusion Detection System (=IDS) - Access control to RDP servers and the role administrator and engineer on the affected device.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–8.8

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Pepperl+Fuchs PSIRT DE

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Microsoft Security Response Center US

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · NVD / NIST USexploitability 2.8 · impact 5.9

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94US

affected products (178)

Products and version ranges known to be affected.

Microsoft Remote Desktop client for Windows Desktop1.2.0.0 → 1.2.2925.0enisa_euvdEU
Microsoft Windows 10 Version 150710.0.10240.0 → 10.0.10240.19235enisa_euvdEU
Microsoft Windows 10 Version 160710.0.14393.0 → 10.0.14393.5006enisa_euvdEU
Microsoft Windows 10 Version 180910.0.0 → 10.0.17763.2686enisa_euvdEU
Microsoft Windows 10 Version 180910.0.17763.0 → 10.0.17763.2686enisa_euvdEU
Microsoft Windows 10 Version 190910.0.0 → 10.0.18363.2158enisa_euvdEU
Microsoft Windows 10 Version 20H210.0.0 → 10.0.19042.1586enisa_euvdEU
Microsoft Windows 10 Version 21H110.0.0 → 10.0.19043.1586enisa_euvdEU
Microsoft Windows 10 Version 21H210.0.19043.0 → 10.0.19044.1586enisa_euvdEU
Microsoft Windows 11 version 21H210.0.0 → 10.0.22000.556enisa_euvdEU
Microsoft Windows 76.1.0 → 6.1.7601.25898enisa_euvdEU
Microsoft Windows 7 Service Pack 16.1.0 → 6.1.7601.25898enisa_euvdEU
Microsoft Windows 8.16.3.0 → 6.3.9600.20303enisa_euvdEU
Microsoft Windows Server 2008 R2 Service Pack 16.1.7601.0 → 6.1.7601.25898enisa_euvdEU
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)6.1.7601.0 → 6.1.7601.25898enisa_euvdEU
Microsoft Windows Server 2008 Service Pack 26.0.6003.0 → 6.0.6003.21416enisa_euvdEU
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)6.0.6003.0 → 6.0.6003.21416enisa_euvdEU
Microsoft Windows Server 20126.2.9200.0 → 6.2.9200.23645enisa_euvdEU
Microsoft Windows Server 2012 (Server Core installation)6.2.9200.0 → 6.2.9200.23645enisa_euvdEU
Microsoft Windows Server 2012 R26.3.9600.0 → 6.3.9600.20303enisa_euvdEU

showing 20 of 178

advisories (2)

Vendor and ecosystem advisories describing this.

VDE-2022-012Pepperl+Fuchs: Vulnerability in multiple VisuNet devices2022-04-26csaf · pepperl_fuchs_psirtDE
Critical vulnerabilities have been discovered in the utilized component Remote Desktop Client by Microsoft.For more information see: https://msrc.microsoft.com/update-guide/vulnerability/CVE- 2022-21990
msrc_CVE-2022-21990Remote Desktop Client Remote Code Execution Vulnerability2022-03-08csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu pepperl_fuchs_psirt msrc_csaf NVD CVE.org MITRE

published 2022-03-09modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan