Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-103575Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Use-after-free vulnerability in the Remote Desktop Client component of Windows allows an attacker to execute arbitrary code on a victim's machine over a network. The vulnerability requires user interaction—the attacker must trick the user into opening a malicious file or connecting to a malicious Remote Desktop server. If successful, the attacker gains code execution with the privileges of the logged-in user.
What this means
What could happen
An attacker who tricks a user into opening a malicious file or connecting to a compromised Remote Desktop server could run arbitrary code on the affected machine with the same privileges as the logged-in user, potentially compromising workstations, servers, and any systems they have access to.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should apply the patch. This affects workstations and servers used by engineering staff, IT administrators, and any users who access remote systems. In industrial settings, compromise of a workstation with access to engineering networks or SCADA systems could lead to unauthorized process changes.
How it could be exploited
An attacker sends a specially crafted file or sets up a malicious Remote Desktop server. When a user interacts with the file or connects to the server in their Remote Desktop Client, the use-after-free vulnerability is triggered, allowing the attacker to execute arbitrary code on the user's machine. The attack requires user interaction (clicking a file or accepting a connection) but no authentication from the attacker.
Prerequisites
- User interaction required: victim must open a malicious file or connect to attacker-controlled Remote Desktop server
- Network access to the victim's machine or ability to deliver a malicious file to the user
remotely exploitablelow complexityrequires user interaction (not no authentication, but reduces barriers)high CVSS score (8.8)
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/2HARDENINGEducate users not to open files from untrusted sources or connect to unfamiliar Remote Desktop servers
HARDENINGRestrict Remote Desktop access (port 3389) to authorized networks and hosts using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update for your Windows version and architecture
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/bfa9f4ef-0614-4ba1-a256-6e1735f648ecGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.