OTPulse

Remote Desktop Client Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-69984Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

A use-after-free vulnerability exists in Remote Desktop Client that allows an unauthorized attacker to execute code over the network. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 in both standard and Server Core installations. Microsoft has released security updates for all affected versions. The vulnerability requires network access and user interaction to exploit but could result in complete system compromise if successfully exploited.

What this means
What could happen
An attacker could execute code on a Windows machine running Remote Desktop Client by sending a specially crafted network request, potentially allowing them to take full control of the system and access any data or applications on it.
Who's at risk
Organizations running Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems that have Remote Desktop Client enabled. This particularly affects utilities and water authorities that use Windows servers for SCADA front-end systems, engineering workstations for remote equipment access, or centralized monitoring stations where Remote Desktop is used for system administration or remote operations support.
How it could be exploited
An attacker sends a malicious network packet to a machine running vulnerable Remote Desktop Client software. If a user is connected or the client accepts the connection, the use-after-free vulnerability in the Remote Desktop protocol handler allows the attacker's code to run with the same privileges as the user, giving them control of the machine.
Prerequisites
  • Network access to the machine running Remote Desktop Client (port 3389 or RDP service)
  • User interaction required - a user must be connected to or accepting Remote Desktop connections
  • Vulnerable version of Windows with unpatched Remote Desktop Client
Remotely exploitable over networkRequires user interactionHigh complexity to exploitAffects multiple Windows versions across broad range of systems
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDRestrict network access to Remote Desktop services to trusted networks only using firewall rules; block inbound connections to port 3389 from untrusted segments
HARDENINGDisable Remote Desktop Client on machines that do not require it for operations
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

Windows Server 2022
HOTFIXUpdate to the specific patched build for your Windows version (e.g., Build 10.0.19044.7807 for Windows 10 versions 21H2/22H2, Build 10.0.20348.5761 for Windows Server 2022, Build 10.0.26100.33650 for Windows Server 2025)
All products
HOTFIXApply the 2026-October Microsoft security update to Windows 10 and Windows Server systems immediately
View full vendor advisory
API: /api/v1/advisories/c599b68b-0607-45ea-bed7-d52afd089ff2

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Remote Desktop Client Remote Code Execution Vulnerability | CVSS 7.5 - OTPulse