← Vulnerability feed

Vulnerability record · CVE-2006-4465 · published 31 August 2006

CVE-2006-4465: Microsoft terminal server vulnerability

Microsoft · Terminal Server

Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile and Client Connection Manager wizard" options, allows local users to execute arbitrary code by forcing an Explorer error. NOTE: a third-party researcher has stated that the options are "a convenience to users" and were not intended to restrict execution of arbitrary code

10.0 CVSS 2.0 High EPSS 9.4% · top 4.7%
10.0CVSS 2.0 base score
9.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Microsoft Terminal Server, when running an application session with the "Start program at logon" and "Override settings from user profile and Client Connection Manager wizard" options, allows local users to execute arbitrary code by forcing an Explorer error. NOTE: a third-party researcher has stated that the options are "a convenience to users" and were not intended to restrict execution of arbitrary code

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://securityreason.com/securityalert/1486
http://wklpc.blogspot.com/2006/08/easy-ms-terminal-server-desktop-hack.html Exploit
http://www.securityfocus.com/archive/1/443364/100/200/threaded
http://www.securityfocus.com/archive/1/443428/100/200/threaded
http://securityreason.com/securityalert/1486
http://wklpc.blogspot.com/2006/08/easy-ms-terminal-server-desktop-hack.html Exploit
http://www.securityfocus.com/archive/1/443364/100/200/threaded
http://www.securityfocus.com/archive/1/443428/100/200/threaded

Track CVE-2006-4465 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2000-0305Beos vulnerabilityWindows 95, Windows 98, Windows 2000, Windows NT 4.0, and Terminal Server systems allow a remote attacker to cause a denial of service by sending a l…EPSS 38%7.5CVE-2007-2593Microsoft terminal server vulnerabilityThe Terminal Server in Microsoft Windows 2003 Server, when using TLS, allows remote attackers to bypass SSL and self-signed certificate requirements,…EPSS 9.4%7.5CVE-1999-0909Microsoft terminal server permissions and access controls vulnerabilityMultihomed Windows systems allow a remote attacker to bypass IP source routing restrictions via a malformed packet with IP options, aka the "Spoofed …EPSS 12%7.5CVE-1999-0391Microsoft terminal server vulnerabilityThe cryptographic challenge of SMB authentication in Windows 95 and Windows 98 can be reused, allowing an attacker to replay the response and imperso…EPSS 4.9%7.2CVE-2000-0259Microsoft terminal server vulnerabilityThe default permissions for the Cryptography\Offload registry key used by the OffloadModExpo in Windows NT 4.0 allows local users to obtain compromis…EPSS 1.5%5.0CVE-2001-0540Windows Terminal Server RDP memory leak denial of serviceTerminal Services in Windows NT and Windows 2000 leaks memory when handling malformed Remote Desktop Protocol requests on port 3389. Repeated malform…EPSS 71%analysed5.0CVE-2000-0404Microsoft terminal server vulnerabilityThe CIFS Computer Browser service allows remote attackers to cause a denial of service by sending a ResetBrowser frame to the Master Browser, aka the…EPSS 18%5.0CVE-2000-0331Microsoft terminal server vulnerabilityBuffer overflow in Microsoft command processor (CMD.EXE) for Windows NT and Windows 2000 allows a local user to cause a denial of service via a long …EPSS 7.5%

Source: NIST National Vulnerability Database (record CVE-2006-4465), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.