Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69995Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in Remote Desktop Client allows an unauthorized attacker to execute code over a network. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025 across multiple architectures (32-bit, x64, ARM64). Microsoft has released security updates for all affected versions. User interaction may be required to trigger exploitation.
What this means
What could happen
An attacker could execute arbitrary code on a Windows system running Remote Desktop Client by sending a specially crafted RDP message, potentially allowing them to run commands, access sensitive data, or disrupt the system.
Who's at risk
This vulnerability affects any organization running Windows desktops or servers that use Remote Desktop Client for remote administration or access. IT teams managing Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems should prioritize patching. Utilities and critical infrastructure operators relying on RDP for remote workstation access or server management are particularly at risk if systems are exposed to untrusted networks.
How it could be exploited
An attacker sends a specially crafted Remote Desktop Protocol (RDP) message to a system running Remote Desktop Client. The use-after-free vulnerability in the RDP client allows the attacker's code to execute without requiring authentication to the target system. User interaction may be required to trigger the vulnerability.
Prerequisites
- Network access to the RDP client port (typically 3389)
- A system running one of the affected Windows versions with Remote Desktop Client enabled
- User interaction may be required to trigger the vulnerability
remotely exploitableuser interaction requiredaffects remote administration capabilitywidespread impact across Windows versionslow EPSS score but vendor confirms patch available
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to RDP port (3389) using firewall rules—only allow RDP connections from trusted administrative networks and block from the internet
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the 2026-Oct security update to all affected Windows systems (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, 2025)
All products
HARDENINGDisable Remote Desktop Client on systems that do not require it
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/914fe107-8d59-4922-a6c6-a3b2178c3655Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.