Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-70004Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free vulnerability in Windows Remote Desktop Client allows an unauthorized attacker to execute arbitrary code over a network without authentication. The vulnerability is triggered by a specially crafted network packet and affects all supported versions of Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
A remote attacker could execute code on a Windows workstation or server running Remote Desktop Client by sending a specially crafted network packet, potentially allowing them to take full control of the system, access sensitive data, or disrupt operations.
Who's at risk
Any organization running Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, or 2025 with Remote Desktop Client enabled or in use. This affects IT staff, SCADA/HMI workstations accessing control systems, and any Windows device used for remote administration of critical infrastructure or OT systems.
How it could be exploited
An attacker sends a malicious network packet designed to trigger a use-after-free memory error in Remote Desktop Client. If a user is running a vulnerable version of RDC, the attacker's packet causes the application to execute arbitrary code with the privileges of the logged-in user, without requiring the user to take any additional action beyond having RDC running.
Prerequisites
- Network access to the system running Remote Desktop Client
- Vulnerable version of Windows with RDC service or client installed and running
- No user credentials required; exploitation occurs during normal RDC operation
remotely exploitableno authentication requiredaffects remote access to control systemshigh complexity attack (user interaction and specific network conditions required)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDRestrict network access to Remote Desktop Protocol (RDP, port 3389) at the firewall to only authorized administrative workstations or jump servers.
WORKAROUNDDisable RDP on systems that do not require remote access for administration or operations.
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update (or later monthly rollup) to all Windows 10 and Windows 11 systems, and all Windows Server versions (2016, 2019, 2022, 2025).
Long-term hardening
0/1HARDENINGUse VPN or SSH jump host as an alternative to direct RDP exposure on the network perimeter.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/f09482bb-70e2-4639-8f32-0645ace00ba1Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.