Remote Desktop Services Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69992Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in Windows Remote Desktop Services allows an unauthenticated attacker on the network to execute arbitrary code by sending a specially crafted request to RDS. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 across 32-bit, x64, and ARM64 architectures.
What this means
What could happen
An attacker could execute commands on a Windows system running Remote Desktop Services without authentication, potentially allowing them to control the machine, access sensitive data, or disrupt critical operations in facilities that rely on Windows servers for process control or SCADA integration.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025 for SCADA servers, data historians, or engineering workstations, as well as those using Windows 10 or 11 systems with Remote Desktop Services enabled in industrial environments. This affects any facility relying on Windows-based remote access for process control or system management.
How it could be exploited
An attacker on the network sends a specially crafted request to the Remote Desktop Services port (typically 3389). The use-after-free vulnerability in RDS processing allows the attacker to run code with the privileges of the RDS service. No user interaction or credentials are required.
Prerequisites
- Network access to Remote Desktop Services port 3389 or configured RDS port
- Windows system with Remote Desktop Services enabled
remotely exploitableno authentication requiredlow complexityaffects Windows infrastructure used in OT environments
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to Remote Desktop Services port (3389 by default) to only authorized administrative networks using firewall rules or network segmentation
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update from Microsoft to all Windows 10, Windows 11, and Windows Server systems listed in the affected products table
Long-term hardening
0/2HARDENINGDisable Remote Desktop Services on systems that do not require it for operations or remote management
HARDENINGRequire multi-factor authentication for all Remote Desktop Services connections to add an additional layer of protection
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/734df701-4f05-45af-a05f-6a4752490c21Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.