OTPulse

Remote Desktop Client Remote Code Execution Vulnerability

Plan PatchCVSS 7.5CVE-2026-69997Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary

Use-after-free vulnerability in Remote Desktop Client allows an unauthorized attacker to execute code over a network. The vulnerability exists in the RDP protocol handler when processing specially crafted network messages, potentially allowing remote code execution without authentication. Affected versions include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, 26H2), Windows Server 2016, 2019, 2022, and 2025. Exploitation is assessed as less likely but patches have been released by Microsoft.

What this means
What could happen
An attacker could execute arbitrary code on Windows systems running Remote Desktop Client by sending a specially crafted network message, potentially gaining full control of the affected computer and any systems it connects to.
Who's at risk
This affects IT administrators and operators managing Windows-based systems, particularly those running Windows Server 2016, 2019, 2022, or 2025, and Windows 10/11 workstations that have Remote Desktop enabled. Any system exposed to remote access or used for remote management is at risk.
How it could be exploited
An attacker sends a malicious message over the network to a system running Remote Desktop Client. The vulnerability (use-after-free) in the RDP protocol handler allows the attacker's code to run with the same permissions as the user running Remote Desktop Client, without requiring the user to authenticate or click anything unusual.
Prerequisites
  • Network reachability to the target system on the RDP listening port (default 3389)
  • Target system must be running an affected Windows version with Remote Desktop enabled
  • No user credentials required; no authentication needed
Remotely exploitable over networkNo authentication required to trigger vulnerabilityMedium attack complexity (user action required)Affects Windows Server systems used for administrative accessHigh impact if compromised (full system control)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/4
Do now
0/3
WORKAROUNDDisable Remote Desktop Protocol (RDP) on systems that do not require remote access
HARDENINGRestrict network access to RDP port 3389 using firewall rules to only authorized administrative networks or IP addresses
HARDENINGIf RDP must remain enabled, require Network Level Authentication (NLA) in Remote Desktop settings to add an extra authentication barrier
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXApply October 2026 Windows security update (Build 10.0.17763.9376 for Windows Server 2019; Build 10.0.20348.5761 for Windows Server 2022; Build 10.0.26100.33650 for Windows Server 2025; or corresponding Windows 10/11 builds as listed)
View full vendor advisory
API: /api/v1/advisories/fb077b22-1d3e-4dd4-973f-4886239ed52c

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Remote Desktop Client Remote Code Execution Vulnerability | CVSS 7.5 - OTPulse