OTPulse

Remote Desktop Gateway Service Remote Code Execution Vulnerability

Plan PatchCVSS 8.1CVE-2026-100218Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

A use-after-free vulnerability in the Remote Desktop Gateway Service allows an unauthenticated attacker to execute code remotely over the network.

What this means
What could happen
An attacker could remotely run code on your Remote Desktop Gateway server, potentially taking control of the system and accessing systems behind the gateway or interrupting remote access for staff.
Who's at risk
Organizations running Remote Desktop Gateway on Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should apply this update. This affects any IT department using Remote Desktop Gateway to provide secure remote access for staff or field personnel, and any municipality or utility with hybrid/remote workforce access to critical systems.
How it could be exploited
An attacker sends a specially crafted network packet to the Remote Desktop Gateway Service port without needing credentials or user interaction. The use-after-free vulnerability in the service processes this packet incorrectly, allowing the attacker to execute arbitrary code with the privileges of the Gateway Service.
Prerequisites
  • Network access to Remote Desktop Gateway Service port (typically TCP 443 or 3388)
  • No credentials or authentication required
remotely exploitableno authentication requiredaffects systems handling critical remote access
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 11 Version 25H2 for x64-based SystemsAll versionsBuild 10.0.26200.9711
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows Server 2025All versionsBuild 10.0.26100.33650
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDRestrict network access to Remote Desktop Gateway Service ports to only authorized users and networks; use firewall rules to block untrusted inbound connections
HARDENINGReview Remote Desktop Gateway access logs to identify if this vulnerability has been exploited
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply October 2026 Windows security update for your operating system version (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025)
View full vendor advisory
API: /api/v1/advisories/9b145632-3ec5-430f-9bd6-bc0526a67d72

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.