OTPulse

Remote Desktop Client Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-69991Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

A use-after-free vulnerability in the Windows Remote Desktop Client allows an unauthorized attacker to execute code on affected systems over a network. The vulnerability affects Windows 10, Windows 11, and Windows Server 2016 through 2025. Microsoft has released patches for all affected versions and rates exploitation as unlikely in the current threat environment.

What this means
What could happen
An attacker could execute arbitrary code on a Windows workstation or server by sending a specially crafted Remote Desktop Protocol (RDP) message, potentially gaining full control of the system without needing valid credentials.
Who's at risk
This affects IT staff and network administrators who manage Windows workstations (Windows 10, Windows 11) and Windows servers (Windows Server 2016, 2019, 2022, 2025) in your organization. Any system with Remote Desktop enabled is at risk, including administrative workstations, remote access servers, and engineer laptops used for plant operations or IT management.
How it could be exploited
An attacker on the network sends a malicious RDP packet to a Windows system with Remote Desktop enabled. The victim does not need to interact with anything; the code executes when the system processes the packet. The attacker gains the ability to run commands with the privileges of the user running the RDP service.
Prerequisites
  • Network access to port 3389 (RDP port)
  • Remote Desktop Protocol (RDP) enabled on the target system
  • System must be a Windows OS version listed in affected products
remotely exploitableno authentication requiredaffects Windows workstations and serverslow to moderate attack complexity
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 11 Version 26H2 for ARM64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 11 Version 26H2 for x64-based SystemsAll versionsBuild 10.0.26300.9711
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Remediation & Mitigation
0/4
Do now
0/3
HARDENINGDisable Remote Desktop Protocol (RDP) on systems that do not require it
WORKAROUNDRestrict network access to port 3389 (RDP) using firewall rules to allow only trusted administrative networks
HARDENINGRequire multi-factor authentication (MFA) for RDP connections to reduce risk while patches are being deployed
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply October 2026 Windows security update to all affected systems
View full vendor advisory
API: /api/v1/advisories/ab52d6c3-6a4f-481c-bf97-b16b1eb33a6d

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.