OTPulse

Remote Desktop Services Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-69514Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

A heap-based buffer overflow vulnerability exists in Windows Remote Desktop Services. An authorized attacker with valid RDP credentials can exploit this vulnerability by sending a specially crafted network packet, allowing them to execute arbitrary code on the affected system. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows Server (2016, 2019, 2022, 2025) across multiple CPU architectures.

What this means
What could happen
An attacker with valid credentials could execute arbitrary commands on a Windows system running Remote Desktop Services, potentially compromising control of the host machine or any connected systems.
Who's at risk
Windows IT staff managing Windows Server systems used for administrative access, particularly those using Windows Server 2016, 2019, 2022, or 2025 as jump hosts or administrative servers. Windows 10 systems used for remote administration are also affected.
How it could be exploited
An attacker with valid RDP credentials connects to a vulnerable Remote Desktop Services instance and sends a specially crafted network packet that triggers a heap buffer overflow in the RDS service. This allows the attacker to execute code with the privileges of the RDS service.
Prerequisites
  • Valid RDP user account credentials
  • Network access to RDP port (typically 3389)
  • Target system running vulnerable Windows version with Remote Desktop Services enabled
remotely exploitablerequires valid credentialsaffects administrative accesshigh CVSS score (7.5)
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9245
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9245
Windows Server 2019All versionsBuild 10.0.17763.9245
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9245
Windows Server 2022All versionsBuild 10.0.20348.5622
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict RDP access to only authorized networks using firewall rules, blocking port 3389 from untrusted networks
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXApply the September 2026 Windows security update to all affected Windows 10 and Windows Server systems
HARDENINGDisable Remote Desktop Services on systems that do not require remote access capability
Long-term hardening
0/1
HARDENINGEnforce multi-factor authentication on RDP user accounts to increase the difficulty of credential-based attacks
View full vendor advisory
API: /api/v1/advisories/6aaab299-a541-43d7-ab3d-e98c89128cb0

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.