Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-108458Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Use-after-free vulnerability in Remote Desktop Client allows unauthorized remote code execution over the network. An attacker can exploit memory handling flaws to execute arbitrary code on affected Windows systems with active RDP sessions or listening RDP services.
What this means
What could happen
A remote attacker could execute arbitrary code on a Windows workstation or server running Remote Desktop Client by sending a specially crafted network packet, potentially compromising the device and gaining access to connected systems or data.
Who's at risk
Organizations operating Windows workstations or servers used for remote administration need to apply this update. This includes IT support staff at water authorities and utilities who use Remote Desktop for system management, as well as any servers providing RDP access for plant engineering workstations or SCADA system interfaces.
How it could be exploited
An attacker sends a malicious packet to a Windows system running Remote Desktop Client over the network. If a user has an active RDP session or the RDP service is listening, the vulnerability in memory handling could allow the attacker's code to run with the privileges of the RDP process.
Prerequisites
- Network access to the Windows system over the network (port 3389 for RDP or inbound network connectivity to systems with RDP Client)
- Remote Desktop Client service enabled or RDP session active on the target system
- User interaction may be required depending on RDP connection state
remotely exploitablelow complexityno authentication required for some attack vectorsaffects Windows servers used in OT environments
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to Remote Desktop Protocol (RDP) on port 3389 using firewall rules to allow only trusted administration networks
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 Microsoft security update to all affected Windows versions (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025)
Long-term hardening
0/1HARDENINGDisable RDP service on systems that do not require remote access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/05944875-3b33-4729-929e-068475c59eddGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.