An up-to-date Windows 10 client is connecting to a Windows 10 RDP host which is stuck at 1511 (host can't be updated and 1511 is out of support for receiving patches such as the CVE-2018-0886 mitigation).
What exactly is the exposure going over public internet? Is there another way to mitigate the exposure other than installing a software patch?
Specifically: my understanding is that CVE-2018-0886 requires a man-in-the-middle setup to initiate an attack. If the client and host are both connected to trusted providers, does it still leave an opportunity for a MITM (intermediate nodes between the providers)?
Also: when initiating an RDP connection, there is often a prompt to accept a certificate (as shown in this question), and it seems to re-appear from time to time between the same pair of client and host. This suggests to me that the RDP host is generating and periodically re-generating a self-signed certificate, which seems to me to be the point at which a MITM can insert itself. Is there any procedure by which the host can generate a long-lived certificate (even if self-signed) which can be transferred to a client (by secure connection) so that the trust relationship is maintained (no prompt to trust a self-signed cert over a questionable connection)? And, in doing this, does it not mitigate the CVE-2018-0886 vulnerability without having to do any patching?