Windows Remote Desktop Protocol Information Disclosure Vulnerability
MonitorCVSS 5.3CVE-2026-102198Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in Windows Remote Desktop Protocol allows an authenticated attacker to disclose information from system memory over the network. The vulnerability affects Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025. Microsoft has released patches for all affected versions.
What this means
What could happen
An authenticated attacker with network access to the Remote Desktop Protocol service could read sensitive data from system memory, potentially exposing credentials, encryption keys, or operational configuration details used by connected workstations or HMI systems.
Who's at risk
Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems. This affects engineering workstations, HMI servers, historian databases, and any administrative systems in water utilities or electric utilities that use Remote Desktop for remote administration of control systems or SCADA platforms.
How it could be exploited
An attacker with valid credentials connects to a vulnerable system's Remote Desktop Protocol (RDP) service over the network. During the RDP session, the attacker triggers an out-of-bounds read condition in the RDP handler, causing the system to leak data from adjacent memory regions to the attacker's session.
Prerequisites
- Network access to RDP port (typically port 3389)
- Valid user credentials for RDP authentication
- RDP service enabled on the target system
remotely exploitablerequires valid credentialsaffects administrative access pathsmemory disclosure could expose operational data
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDRestrict RDP access to engineering workstations and administrative systems using network firewall rules; block RDP port 3389 from untrusted networks and limit connections to specific management subnets
HARDENINGDisable RDP on systems that do not require remote access, particularly industrial equipment or visualization servers not used for remote administration
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update to all affected Windows versions running on engineering workstations, HMI servers, and administrative systems
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate RDP-enabled systems into a separate administrative network, separate from operational technology networks running PLCs, HMIs, and RTUs
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f0704410-7745-4fbf-94a9-27f12f0860f6Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.