Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69976Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in Remote Desktop Client allows an unauthenticated attacker to execute code over a network when a user connects to a malicious RDP server or accepts a malicious RDP connection.
What this means
What could happen
An attacker could run arbitrary code on engineering workstations or operator terminals used for remote management of control systems. This could allow them to intercept, modify, or block communications to PLCs and other devices.
Who's at risk
Engineering teams and operators at utilities, water authorities, and industrial facilities who use Remote Desktop to manage control systems from Windows workstations or operator terminals (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, 2025).
How it could be exploited
An attacker sets up a malicious Remote Desktop server or intercepts an RDP connection, and crafts a payload that triggers the use-after-free flaw when the user's RDP client processes the connection. The attacker gains code execution in the context of the logged-in user.
Prerequisites
- User must initiate an RDP connection (either to attacker's server or intercepted connection)
- User interaction required (establishing RDP session)
- Attacker must be network-reachable or positioned to intercept RDP traffic
remotely exploitableuser interaction requiredaffects workstations used for OT managementlow EPSS score but vendor-patched
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/3HARDENINGRestrict RDP access from engineering workstations to only authorized control system servers using Windows Firewall or network firewall rules.
HARDENINGDisable RDP on systems that do not require remote management, and disable RDP server on engineering workstations that only need to connect outbound.
WORKAROUNDEducate operators not to accept RDP connections from unknown or unexpected sources, and validate server identity before connecting.
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply October 2026 security update to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems. Coordinate with IT to schedule patches during maintenance windows to minimize operational disruption.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/3b72e5c8-d1c3-4aed-b378-2e71e3a08fbaGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.