CVE-2025-55340: Windows 10 21h2 Auth Bypass Vulnerability

CVE-2025-55340 Overview

CVE-2025-55340 is an improper authentication vulnerability in the Windows Remote Desktop Protocol (RDP) service. An authorized attacker with local access and low privileges can bypass a security feature enforced by RDP. Microsoft rates the issue HIGH with a CVSS 3.1 base score of 7.0. The weakness is classified as [CWE-287] Improper Authentication.

The flaw affects multiple supported branches of Windows client and Windows Server, including Windows 10, Windows 11, and Windows Server 2022 and 2025. Successful exploitation impacts confidentiality, integrity, and availability of the target system.

Critical Impact
A local, authenticated attacker can bypass an RDP security feature on current Windows and Windows Server releases, undermining a control designed to protect remote desktop sessions.

Affected Products

Microsoft Windows 10 21H2 and 22H2
Microsoft Windows 11 22H2, 23H2, 24H2, and 25H2
Microsoft Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025

Discovery Timeline

2025-10-14 - CVE-2025-55340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55340

Vulnerability Analysis

The vulnerability sits in the authentication path of the Windows Remote Desktop Protocol service. RDP fails to correctly enforce a security feature check for an authenticated session, allowing that check to be bypassed. Because the attack vector is local, the attacker must already have low-privilege access on the target host before invoking the vulnerable code path.

Exploitation is not straightforward. Microsoft's assessment reflects high attack complexity, indicating that success depends on conditions outside the attacker's direct control, such as timing or specific session state. When those conditions align, the attacker can defeat the intended RDP protection and gain access that yields high impact to confidentiality, integrity, and availability.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. The EPSS forecast is low, but the presence of the flaw across every supported desktop and server SKU means the attack surface is broad.

Root Cause

The root cause is improper authentication [CWE-287] in the RDP implementation. The service accepts a state or credential context that should have been rejected under the security feature it enforces. That gap allows a low-privileged local user to reach functionality that should be gated behind a stronger authentication decision.

Attack Vector

The attack requires local access with existing low privileges on the target and no user interaction. An attacker interacts with RDP components on the affected machine to trigger the flawed authentication path. Because scope is unchanged, the attacker gains impact within the same security authority as the vulnerable component, but that impact is rated high across the confidentiality, integrity, and availability dimensions.

No verified exploit code is publicly available. Refer to the Microsoft CVE-2025-55340 Advisory for vendor technical details.

Detection Methods for CVE-2025-55340

Indicators of Compromise

Unexpected local RDP session establishment or reconnection events on hosts where interactive RDP use is not routine.
Windows Security event log entries showing successful RDP authentication that skipped expected security feature enforcement.
Local logons from low-privileged accounts followed by RDP-related process activity such as mstsc.exe or TSTheme.exe in unusual contexts.

Detection Strategies

Monitor Windows Event IDs 4624 (logon type 10 or 7) and 4778/4779 for anomalous local RDP session activity tied to standard user accounts.
Correlate RDP service (TermService) activity with local privilege changes and subsequent access to sensitive resources.
Baseline normal RDP usage per host and alert on deviations, especially on servers where console-only administration is expected.

Monitoring Recommendations

Enable and forward Microsoft-Windows-TerminalServices-LocalSessionManager and RemoteConnectionManager operational logs to a central SIEM.
Track patch state of the affected Windows and Windows Server builds and flag hosts missing the October 2025 cumulative update.
Review scheduled tasks, services, and startup entries introduced by non-administrative accounts on RDP-enabled endpoints.

How to Mitigate CVE-2025-55340

Immediate Actions Required

Apply the October 2025 Microsoft security update that addresses CVE-2025-55340 to all affected Windows 10, Windows 11, and Windows Server systems.
Restrict local interactive logon rights so that only required accounts can access RDP-enabled hosts.
Audit membership of the Remote Desktop Users and local Administrators groups and remove unnecessary accounts.

Patch Information

Microsoft has released fixes through its standard security update channel. See the Microsoft CVE-2025-55340 Advisory for the specific KB articles that correspond to each affected build of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025.

Workarounds

Where patching must be delayed, disable the Remote Desktop Services (TermService) role on hosts that do not require RDP.
Enforce Network Level Authentication (NLA) and require strong, unique credentials for any account permitted to establish RDP sessions.
Use host-based firewall rules or Windows Defender Firewall to block inbound TCP/3389 except from trusted management subnets, reducing the population of accounts that can reach the vulnerable code path.

bash

# Example: disable RDP service on hosts that do not need it
sc.exe config TermService start= disabled
sc.exe stop TermService

# Example: block inbound RDP at the host firewall
netsh advfirewall firewall add rule name="Block Inbound RDP" ^
  dir=in action=block protocol=TCP localport=3389