Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69988Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in Remote Desktop Client allows an attacker to execute code over a network without authentication. The vulnerability exists in Remote Desktop components and affects multiple Windows versions and Windows Server releases across 32-bit, x64, and ARM64 architectures.
What this means
What could happen
An attacker could execute arbitrary code on an operator workstation or server running Remote Desktop Client, potentially compromising the system and any connected SCADA/HMI systems or networks it can access.
Who's at risk
Organizations running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), or Windows Server (2016, 2019, 2022, 2025) should be concerned, particularly those with engineering workstations, HMI systems, or administrative servers that use Remote Desktop Client to access OT systems, field sites, or other critical networks.
How it could be exploited
An attacker sends a specially crafted network packet to a system running vulnerable Remote Desktop Client. If the user is running or using Remote Desktop Client at the time, the attacker's code executes with the privileges of the user running the client.
Prerequisites
- Network access to a system running Remote Desktop Client
- User must be actively using or have Remote Desktop Client running
- No valid credentials required
remotely exploitableno authentication requiredaffects engineering workstations and administrative systems
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update to all systems running Windows 10, Windows 11, or Windows Server editions listed in the advisory
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/34ff22ad-26df-406f-a384-0b2eaa2c1284Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.