OTPulse

Remote Desktop Client Remote Code Execution Vulnerability

Plan PatchCVSS 8.8CVE-2026-68828Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

What this means
What could happen
An attacker could run arbitrary code on a Windows machine with Remote Desktop access enabled, potentially taking control of the system or disrupting critical operations.
Who's at risk
Organizations using Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025 are affected, particularly systems with Remote Desktop Protocol enabled. This includes IT operations staff using RDP for remote administration of servers, workstations, and edge devices in utilities, manufacturing, and critical infrastructure.
How it could be exploited
An attacker sends a specially crafted Remote Desktop Protocol (RDP) message to a system with RDP enabled. When processed, the malformed data overflows a heap buffer, allowing the attacker to inject and execute arbitrary code on the target machine.
Prerequisites
  • Remote Desktop Protocol (RDP) enabled on the target system
  • Attacker must have network access to port 3389 (default RDP port)
remotely exploitablelow complexityno authentication requiredhigh CVSS score (8.8)
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDRestrict network access to port 3389 (RDP) from untrusted networks using firewall rules
WORKAROUNDDisable Remote Desktop Protocol on systems that do not require it
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Windows September 2026 security update immediately to affected systems
Long-term hardening
0/1
HARDENINGImplement network segmentation to limit RDP access to authorized administrative networks only
View full vendor advisory
API: /api/v1/advisories/72074b41-2d6e-42ce-80c5-674fcc3a177b

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Remote Desktop Client Remote Code Execution Vulnerability | CVSS 8.8 - OTPulse