The host is missing a security update according to Microsoft advisory, 2868725. The update is required to remove RC4 as an available cipher on affected systems through registry settings. The flaw is present in the application, which fails to handle crafted data. Successful exploitation could allow an attacker to perform man-in-the-middle attacks and recover plaintext from encrypted sessions.