Microsoft has officially confirmed a known issue affecting Remote Desktop Protocol (RDP) connections following the April 14, 2026, Patch Tuesday updates. Specifically impacting Windows 11 version 26H1 (KB5083768, OS Build 28000.1836), the update was intended to harden systems against malicious .rdp files.
However, a newly introduced user interface bug is causing critical security warnings to render incorrectly, preventing users from properly reading or interacting with the prompts.
The aggressive overhaul of the Remote Desktop Connection application (MSTSC) was a direct response to active in-the-wild exploitation and vulnerability disclosures.
The UK’s National Cyber Security Center (NCSC) flagged a spoofing vulnerability that allowed threat actors to weaponize RDP files in phishing campaigns.
To address this, Microsoft designed the April update to force a detailed security warning that turned off local resource sharing by default.
This blocked automatic access to clipboards, local drives, and connected devices. The update also patched several severe vulnerabilities in the RDP infrastructure.
While the new security guardrails successfully disrupted RDP-based phishing techniques, they introduced a frustrating graphical anomaly.
According to Microsoft, the newly deployed security prompts might display overlapping text and partially hidden action buttons.
This defect fundamentally breaks the interaction flow, as users cannot clearly read the publisher verification status or click the buttons to allow the connection.
The bug is specifically triggered in environments where users operate multiple monitors with different display scaling configurations.
For example, the interface becomes distorted if a user runs their primary display at 100% scaling and a secondary monitor at 125%.
Until Microsoft issues an out-of-band patch or addresses the scaling glitch in an upcoming servicing stack update, systems administrators can deploy a temporary fix.
IT departments heavily reliant on automated RDP workflows can revert the application to its legacy dialog behavior using a localized registry tweak.
To bypass the distorted user interface, administrators must navigate to the HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services\Client registry path.
Within this key, you must create or modify a REG_DWORD value named RedirectionWarningDialogVersion and set its data to 1.
Applying this change immediately suppresses the flawed April 2026 interface, restoring connectivity workflows while temporarily sacrificing the updated phishing visibility.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…