Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69994Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in the Remote Desktop Client allows an attacker to execute code over the network. The vulnerability is triggered when a user connects to a malicious or compromised RDP server that sends a specially crafted packet. Exploitation is assessed as unlikely. Microsoft has released security updates for Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An attacker could execute arbitrary code on Windows computers running Remote Desktop Client, potentially compromising operator workstations that manage critical infrastructure such as SCADA systems or PLCs.
Who's at risk
IT and OT staff at water utilities and municipal electric utilities who use Windows workstations (Windows 10, Windows 11, Windows Server 2016/2019/2022/2025) to manage remote connections to SCADA systems, RTUs, PLCs, or other critical infrastructure. Affects both 32-bit and x64-based systems running all supported versions.
How it could be exploited
An attacker sends a specially crafted network packet to the Remote Desktop Client. If a user connects to a malicious or compromised RDP server, the client processes the packet, triggering a use-after-free memory vulnerability that allows the attacker to run code with the same privileges as the logged-in user.
Prerequisites
- Network access to port 3389 (RDP) or ability to redirect RDP traffic
- User must initiate a Remote Desktop connection to an attacker-controlled or compromised RDP server
- User interaction required (initiating the connection)
remotely exploitableuser interaction requiredaffects operator workstations accessing critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict RDP access (port 3389) at the network perimeter to only authorized engineering workstations and administrative jump servers using firewall rules.
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the 2026-October Windows security update to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems.
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate operator workstations and engineering networks from untrusted external networks to reduce exposure.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/dad6c2e7-cc27-4b7d-b401-f3f01b38e04dGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.