CVE-2026-7830 Ultravnc CVE debrief

Who should care

Users of UltraVNC, especially those using legacy MS-Logon II connections, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes updating UltraVNC to a version that fixes this vulnerability, using MS-Logon III (X25519 + AES-256-GCM) for connections, monitoring for suspicious activity on UltraVNC connections, and considering alternative remote desktop solutions.

Technical summary

UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme. The Diffie-Hellman key exchange is performed with parameters that fit in an unsigned 64-bit integer, making it vulnerable to Pollard's rho algorithm. Additionally, the private exponent is generated by a weak random number generator, allowing a passive observer to recover the private exponent in under a minute.

Defensive priority

High priority should be given to updating UltraVNC to a version that fixes this vulnerability, especially for users of legacy MS-Logon II connections.

Recommended defensive actions

• Update UltraVNC to a version that fixes this vulnerability
• Use MS-Logon III (X25519 + AES-256-GCM) for connections
• Monitor for suspicious activity on UltraVNC connections
• Consider using alternative remote desktop solutions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-01T05:16:24.210Z and was last modified on 2026-07-09T06:16:21.760Z. The NVD entry is currently Modified. This vulnerability affects UltraVNC through 1.8.2.2, specifically in the MS-Logon II authentication scheme. Evidence of exploitation is not publicly available, but defenders should verify UltraVNC configurations and monitor for suspicious activity.

Official resources