OTPulse

Windows Remote Desktop Security Feature Bypass Vulnerability

MonitorCVSS 6.8CVE-2026-59116Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

A weakness in the cryptographic algorithm used by Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over the network. The vulnerability affects Remote Desktop services on Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025. Exploitation is considered unlikely, but the security feature bypass means attackers could potentially gain unauthorized remote access if they can reach the RDP port.

What this means
What could happen
An attacker with network access to Remote Desktop services could bypass security protections that are meant to prevent unauthorized connections, potentially allowing unauthorized remote access to affected Windows systems.
Who's at risk
Windows server administrators and any organization running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 should prioritize this update. This is particularly important for HMI (Human Machine Interface) servers, engineering workstations, and any remote administration infrastructure used in utilities or manufacturing facilities that rely on Remote Desktop for operational support.
How it could be exploited
An attacker sends a specially crafted Remote Desktop Protocol (RDP) message to a Windows system with Remote Desktop enabled. The weak cryptographic implementation in the security feature allows the attacker to bypass the intended protection without valid credentials or authentication, gaining potential access to the system.
Prerequisites
  • Network access to Remote Desktop Protocol (RDP) port 3389
  • Remote Desktop services must be enabled on the target system
remotely exploitableno authentication requiredaffects remote access systems
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict RDP access (port 3389) at the firewall to only authorized administrative workstations and jump hosts
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the October 2026 Windows security update to all affected systems (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025)
Long-term hardening
0/1
HARDENINGDisable Remote Desktop services on systems that do not require remote administrative access
View full vendor advisory
API: /api/v1/advisories/acb3616e-96f9-43a0-94cc-63156f8d2a7d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Windows Remote Desktop Security Feature Bypass Vulnerability | CVSS 6.8 - OTPulse