Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-70006Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
Use-after-free vulnerability in Remote Desktop Client allows an unauthorized attacker to execute code over a network. The vulnerability is in memory management of the RDP client and can be triggered when processing specially crafted remote desktop protocol packets.
What this means
What could happen
An attacker could run arbitrary commands on your engineering workstations or HMI systems via Remote Desktop Protocol, potentially allowing them to modify process setpoints, access historian data, or disrupt local operations.
Who's at risk
Any facility using Windows-based engineering workstations, historian servers, HMI terminals, or remote desktop access for ICS/OT systems—particularly organizations that allow remote access to process control networks. This includes water utilities, electric utilities, and any site using Windows servers or workstations for industrial operations.
How it could be exploited
An attacker crafts malicious RDP packets and sends them to a Windows machine running Remote Desktop Client. When the client processes the packets, the use-after-free condition is triggered, allowing the attacker to inject and execute arbitrary code on the target machine.
Prerequisites
- Network access to port 3389 (RDP port) or connection to a malicious RDP server
- User must initiate or receive an RDP connection attempt with the specially crafted packets
- Target must be running a vulnerable version of Windows with RDP Client enabled
remotely exploitablelow complexity attackrequires user interaction (user initiates RDP connection)affects systems with administrative or process-level access
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/5
Do now
0/1WORKAROUNDRestrict RDP access (port 3389) at the firewall to only authorized engineering workstations and jump hosts; block RDP from untrusted networks
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 security update to all Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
Long-term hardening
0/3HARDENINGDisable Remote Desktop Client on systems that do not require it for operations
HARDENINGSegment engineering workstations and HMI systems from general corporate networks using a DMZ or separate VLAN with restricted access controls
HARDENINGRequire multi-factor authentication for all RDP connections to critical process control systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/232eec74-ead6-4507-9f53-c547c3761dbcGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.