Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
MonitorCVSS 6.5CVE-2026-57982Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A vulnerability in Windows Remote Desktop Protocol (RDP) allows an authorized attacker to read uninitialized memory and disclose sensitive information over the network. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, and 22H2), Windows 11 (versions 24H2, 25H2, and 26H1), and Windows Server 2016, 2019, 2022, and 2025 on 32-bit, x64, and ARM64-based systems. Exploitation requires valid RDP credentials and network access to the RDP service on port 3389.
What this means
What could happen
An attacker with valid credentials and network access to RDP could read sensitive information from the RDP process memory, potentially including passwords or other confidential data used by the system.
Who's at risk
Water utilities and municipalities using Windows servers for SCADA workstations, HMI systems, or data historian platforms that rely on RDP for remote administrative access. This affects engineering workstations, operator stations running Windows 10 or Windows Server 2016 through 2025, and any networked device using RDP for remote management.
How it could be exploited
An attacker with valid network access and RDP credentials connects to the RDP service on the target Windows system and triggers the uninitialized memory condition, allowing them to read data that should not be accessible.
Prerequisites
- Network access to RDP port (3389)
- Valid RDP credentials (username and password)
- RDP service enabled and accepting connections
remotely exploitablerequires valid credentialsaffects administrative access channelslow exploit probability
Exploitability
Unlikely to be exploited — EPSS score 1.0%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/9
Do now
0/1WORKAROUNDRestrict RDP access via firewall rules to only authorized administrative networks
Schedule — requires maintenance window
0/8Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9020 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5386 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33158 or later
All products
HOTFIXUpdate Windows 10 Version 1809 (32-bit) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 1809 (x64) to Build 10.0.17763.9020 or later
HOTFIXUpdate Windows 10 Version 21H2 to Build 10.0.19044.7548 or later
HOTFIXUpdate Windows 10 Version 22H2 to Build 10.0.19045.7548 or later
HOTFIXUpdate Windows 11 versions 24H2 and 25H2 to Build 10.0.26100.8875 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/fe14d3ba-e6c8-4937-adfb-0c06b6edba6dGet OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.