Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69996Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
Use-after-free vulnerability in Remote Desktop Client allows an unauthenticated attacker to execute arbitrary code over a network. The vulnerability exists in all versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. Microsoft has released October 2026 security updates for all affected versions.
What this means
What could happen
An attacker could execute arbitrary code on a Windows workstation or server running Remote Desktop Client by sending a malicious network packet, potentially gaining full control of the machine and any systems it can access on your network.
Who's at risk
IT administrators and operations staff who use Remote Desktop Client to connect to Windows workstations or servers. This includes remote access to SCADA systems, engineering workstations, or control system gateways that run Windows. Any organization using Windows 10 (versions 1607, 1809, 21H2, 22H2) or Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, or 2025 is affected.
How it could be exploited
An attacker sends a specially crafted network packet to a Windows machine running Remote Desktop Client. The packet triggers a use-after-free memory error in the RDP client, allowing the attacker to inject and run arbitrary code with the privileges of the logged-in user.
Prerequisites
- Network connectivity to a Windows machine running Remote Desktop Client
- Target user must be interacting with Remote Desktop Client when the malicious packet arrives (user interaction required)
- No credentials required
remotely exploitableno authentication requireduser interaction required (high complexity)affects administrative access to systems
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to RDP ports (3389 and related Remote Desktop services) using firewall rules to only authorized administrative networks
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security updates to all Windows 10, Windows 11, and Windows Server systems in your environment
Long-term hardening
0/1HARDENINGSegment administrative workstations and servers running Remote Desktop Client onto separate network zones to limit lateral movement if a machine is compromised
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/44d125b3-fe51-48d2-92aa-79c47191629bGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.