iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The “twice-patched Windows RDP vulnerability” refers to CVE-2022-21893, a flaw in how Windows Remote Desktop Services handled named pipes. Microsoft issued an initial fix in January 2022 and a follow-up in April, tracked as CVE-2022-24533, after CyberArk identified a remaining attack path. The disclosed impact was potential—not evidence that attackers had exploited the flaw in the wild.
What CVE-2022-21893 affected
The flaw concerned named-pipe handling inside Windows Remote Desktop Services (RDS). It was not a claim that the RDP network protocol was universally vulnerable. According to CyberArk’s technical explanation, as reported by SecurityWeek, an attacker with ordinary user privileges and access to a machine through RDP could interfere with virtual channels belonging to other connected sessions.
Virtual channels carry session features and redirected resources between a Remote Desktop client and the host. The concern was that interference with those channels could expose or affect information and devices associated with another logged-on user.
Recommended Free Tools
What the reported attack could expose
CyberArk described these as possible consequences of taking over another session’s virtual channels, not as confirmed incidents:
#1 Best Overall
- Access to another user’s client-side file system and data, including clipboard contents and transferred files.
- Exposure of smart-card PINs.
- Access to redirected devices, such as USB devices and hard drives.
- Impersonation of other users logged on to the machine.
CyberArk characterized the potential consequences as privacy issues, lateral movement, and privilege escalation. SecurityWeek quoted the company: “This could lead to data privacy issues, lateral movement and privilege escalation,” CyberArk notes.
Why Microsoft issued two fixes
The two patch rounds addressed the same vulnerability story; the April update was a follow-up after the initial remediation was found to leave a path open. CyberArk’s account, relayed by SecurityWeek, describes the changes this way:
| Remediation | What changed | Remaining concern or added check |
|---|---|---|
| January 2022, CVE-2022-21893 | Microsoft changed named-pipe permissions. | CyberArk’s analysis said the first named-pipe server instance could still influence permissions for later instances, leaving an attack vector. |
| April 2022, CVE-2022-24533 | The update changed pipe naming by generating a GUID for new pipes. | It also added a check that the current process ID matched the pipe server’s process ID. CyberArk considered the risks adequately addressed after these changes. |
In short, changing permissions alone did not resolve the issue described by CyberArk: the way the first instance of a named pipe was created could still matter to later instances. The follow-up altered pipe naming and added process-ID validation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDisclosure and exploitation status
Microsoft’s first remediation was released in January 2022. CyberArk shared technical details publicly in June; SecurityWeek published Ionut Arghire’s account on June 17, 2022. The reviewed disclosure describes a potential attack and its impact, but it does not confirm exploitation in the wild.
Rank #3
What administrators should verify
The exact affected Windows versions and update KB identifiers are not established in the available reporting. For deployment decisions, consult Microsoft’s Security Update Guide and search for CVE-2022-21893 and CVE-2022-24533. Match the guidance to the Windows edition and build in use rather than relying on a generic claim that all RDP systems were affected.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
