OTPulse

Remote Desktop Client Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-69987Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

A use-after-free vulnerability in Windows Remote Desktop Client allows an attacker who can intercept or redirect an RDP connection to execute arbitrary code on the client system. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released fixes in the October 2026 security update.

What this means
What could happen
An attacker could execute arbitrary code on a Windows system running Remote Desktop Client, potentially gaining control of the machine and any OT systems it manages or monitors.
Who's at risk
This affects OT staff and supervisory workstations running Windows 10 or Windows 11, as well as Windows Server systems used for SCADA historian servers, engineering workstations, or remote access gateways. Any IT or OT personnel using Remote Desktop to manage PLCs, RTUs, or other industrial equipment on these operating systems are at risk.
How it could be exploited
An attacker must get an affected Windows system to connect to a malicious RDP server or intercept an RDP connection. When the Remote Desktop Client connects and processes specially crafted data from that server, the use-after-free vulnerability is triggered, allowing code execution on the client machine.
Prerequisites
  • Network connectivity to the target Windows system
  • Target system must initiate or accept an RDP connection
  • User interaction to connect to the RDP server
remotely exploitableuser interaction requiredlow exploit probabilityaffects workstations used for industrial control access
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply October 2026 Microsoft security update to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
View full vendor advisory
API: /api/v1/advisories/7abc3c28-53c0-49be-b81b-6425f5211d6f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.