Key points
- CVE-2026-59116 allows network attackers to bypass Remote Desktop security via weak cryptography.
- Windows 11 update KB5124010 causes Remote Desktop failures for non-admin users with Admin Protection enabled.
- Microsoft advises disabling Admin Protection as a temporary workaround, reducing security posture.
Microsoft has identified a cryptographic vulnerability in Windows Remote Desktop that allows attackers to bypass security features, while simultaneously documenting a configuration conflict that blocks legitimate non-administrator access on updated Windows 11 systems.
How it unfolded
- On September 22, Microsoft released preview update KB5124010, which introduced a conflict with Administrator protection settings on Windows 11 devices.
- In October, Microsoft confirmed that non-administrator users encountered Remote Desktop connection failures, specifically error 0xC000000D, on enterprise-managed hosts.
- Microsoft published an advisory for CVE-2026-59116, a flaw allowing network-based bypass of Remote Desktop security through broken cryptographic algorithms.
Who is affected
Business users on Windows 11 versions 24H2, 25H2, 26H1, and 26H2 are experiencing disruptions. The connection failures primarily impact non-administrator accounts attempting to access enterprise-managed Remote Desktop hosts where Administrator protection is enabled. According to TechRepublic, this issue emerged following recent Windows updates, leaving organizations with a difficult trade-off between maintaining security features and ensuring remote access functionality.
The cryptographic flaw, CVE-2026-59116, affects Windows Remote Desktop by allowing unauthorized attackers to bypass security features over a network. This vulnerability stems from the use of a broken or risky cryptographic algorithm. While the connection failures are a configuration issue, the CVE represents a distinct security risk that could allow attackers to circumvent intended protections.
What happens next
Microsoft has provided a temporary workaround for the connection failures: disabling Administrator protection on affected Remote Desktop hosts. This action restores remote access but temporarily reduces a security safeguard that may be required by enterprise security baselines. Organizations must decide whether to accept this reduced security posture to maintain connectivity or seek alternative access methods until a permanent fix is available.
Administrators should verify their device versions and installed updates before troubleshooting. The recent Windows 11 26H2 rollout uses an enablement package for eligible 24H2 and 25H2 PCs, while 26H1 follows a separate servicing path. Microsoft has not explained the underlying token-validation failure causing the connection errors, but it has distinguished this issue from a separate Remote Desktop Services regression reported in September 2026.
The background in plain language
Remote Desktop allows users to control a computer over a network. Administrator protection is a security feature that limits elevated privileges, requiring Windows Hello authentication for administrative actions like software installation. When this feature is enabled, it can conflict with how non-administrator users authenticate for remote sessions. Teams usually balance security features with usability, but updates can sometimes introduce conflicts that block legitimate access while attempting to enhance protection.
What to do and how to stay safe: Windows 11
- Check if your organization uses Administrator protection on Windows 11 Remote Desktop hosts and monitor for connection errors.
- Verify that all systems are running the latest updates to address known cryptographic vulnerabilities in Remote Desktop.
- Review enterprise security baselines to determine if disabling Administrator protection is an acceptable temporary measure.
- Monitor official Microsoft channels for permanent fixes to both the cryptographic flaw and the connection conflict.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-59116?
It is a vulnerability in Windows Remote Desktop that allows an unauthorized attacker to bypass a security feature over a network due to a broken cryptographic algorithm.
Why are non-admin users failing to connect?
Microsoft linked the failures to Administrator protection enabled on Windows 11 devices after the September 22 preview update KB5124010.
Is there a permanent fix for the connection failures?
Microsoft has provided a temporary workaround by disabling Administrator protection, but no permanent fix has been confirmed yet.
