The CVSS 7.5 assigned to CVE-2026-61352 merits scrutiny. This is a network-exploitable remote code execution vulnerability in the Remote Desktop Client — meaning an attacker need only operate a malicious RDP server and wait for a target to connect. That positioning is trivially achievable; there is no pre-existing access requirement, no credentials needed, no phishing payload to deliver. The victim's own RDP client reaches out to the attacker's server and triggers the vulnerable code path during reconnection. The 'remote code execution' label is accurate. The 7.5 rating asks you to treat this as moderately difficult to exploit, and that disconnect deserves pushback.
The race condition framing compounds the scoring problem. Analysts have internalized that race conditions are inherently probabilistic and therefore hard to exploit — a heuristic that developed in contexts where you already had code execution or local access. Here, the preconditions for the 'hard' part are trivially satisfied. The attacker operates a legitimate RDP server, the client reconnects as part of normal operation, and forced reconnection loops or server-side timing manipulation can narrow the race window significantly. The descriptor functions as a deflator precisely because it triggers priors about difficulty that don't apply when the trigger mechanism is indistinguishable from routine workflow.
Additionally, the privilege context requires scrutiny. The RDP client runs with user-level privileges, which limits direct system impact — but this framing understates the operational reality in enterprise environments. A compromised workstation with user-level code execution is frequently a lateral-movement enabler rather than a ceiling. That machine likely holds SSO tokens, cached credentials, or VPN integrations that make domain access from that foothold nearly trivial. The 'two-step chain' (client code execution plus post-exploitation escalation) is well-worn territory with automated tooling. The blast radius of a 7.5 fails to model what a compromised RDP client actually unlocks in a connected enterprise network.
For defenders: treat this as a high-severity exposure in any environment where RDP clients connect to external or untrusted servers. Prioritize patching on endpoint workloads, not just servers. Review whether your detection logic treats RDP client reconnection as routine traffic or as a potential exploitation trigger. The CVSS number does not capture the positional advantage an attacker gains from simply operating a server that targets will connect to willingly.