Remote Desktop Services Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69539Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in Windows Remote Desktop Services allows an authorized attacker with network access to execute code remotely. The vulnerability exists in RDP protocol handling and requires valid credentials to exploit.
What this means
What could happen
An authenticated attacker on your network could run arbitrary code on Windows servers or workstations running Remote Desktop Services, potentially gaining control of critical systems or HMIs used to manage industrial processes.
Who's at risk
This affects IT staff and operators who use remote access to manage Windows servers, engineering workstations, and HMI systems in your environment. Particularly critical for Windows Server 2016, 2019, 2022, and 2025 deployments that provide remote management or SCADA/HMI interfaces, as well as Windows 10 and 11 workstations used for industrial operations.
How it could be exploited
An attacker with valid network credentials initiates an RDP connection to an affected Windows system. The attacker sends a specially crafted RDP message that triggers the use-after-free condition in the RDP service, allowing code execution in the context of the RDP process.
Prerequisites
- Network access to RDP port (TCP 3389 or custom configured port)
- Valid user credentials to authenticate to the Windows system
- Target system running one of the affected Windows versions with RDP enabled
remotely exploitablerequires authenticationaffects critical server and workstation systems
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDIf immediate patching is not possible, restrict RDP access via firewall rules to limit connections only to authorized internal networks and trusted administrator workstations.
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft's September 2026 security update to all affected Windows systems. Install patches matching your specific Windows version and architecture (see product fixes list).
Long-term hardening
0/2HARDENINGDisable RDP on systems that do not require remote management, or use VPN with additional authentication as a compensating control for remote access.
HARDENINGReview and enforce strong password policies and multi-factor authentication for all accounts with RDP access to reduce the value of credentials an attacker might obtain.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/b8aa28cb-cf94-45dd-a360-371c4bc0ecf2Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.