Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-69998Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability exists in Remote Desktop Client that allows an attacker to execute arbitrary code on a vulnerable system over the network when a user connects to a malicious RDP server. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An attacker could exploit this vulnerability to run arbitrary code on a Windows system running Remote Desktop Client, potentially allowing them to take control of the device and access sensitive data or disrupt operations.
Who's at risk
This affects IT personnel and industrial plant staff who use Remote Desktop Client to connect to engineering workstations, HMI systems, or other Windows-based control devices. Primary concern is for organizations using Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems that provide remote access to critical operations.
How it could be exploited
An attacker sends a specially crafted Remote Desktop Protocol (RDP) message to a vulnerable Remote Desktop Client. If a user opens a connection to a malicious RDP server, the use-after-free vulnerability in the client could be triggered, allowing the attacker to execute code with the privileges of the logged-in user.
Prerequisites
- Network access to a system running vulnerable Remote Desktop Client
- User must initiate or accept an RDP connection to an attacker-controlled or compromised RDP server
remotely exploitableuser interaction requiredhigh CVSS score (7.5)affects access to control systems if used for remote engineering
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Microsoft security update (or later) to all Windows systems running Remote Desktop Client
Long-term hardening
0/2HARDENINGRestrict RDP access to trusted networks and implement network segmentation to limit which systems can initiate RDP connections
HARDENINGRequire multi-factor authentication for any RDP access to engineering workstations or critical systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/be36195e-6a60-40ef-a82f-1f15c609b360Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.