Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 7.5CVE-2026-70012Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A use-after-free memory vulnerability in the Remote Desktop Client allows an unauthorized attacker to execute arbitrary code over a network when a user connects to a malicious or compromised RDP server. This affects Windows 10, Windows 11, and Windows Server 2016/2019/2022/2025 systems.
What this means
What could happen
An attacker could execute arbitrary code on a Windows system running an affected version of Remote Desktop Client, potentially gaining control of that computer if a user is tricked into connecting to a malicious remote host.
Who's at risk
This affects IT staff and remote workers who use Windows Remote Desktop Client to connect to systems. Windows 10 and 11 workstations, Windows Server 2016, 2019, 2022, and 2025 systems are all impacted. Anyone using RDP for remote access, management, or troubleshooting should update immediately.
How it could be exploited
An attacker sets up a malicious RDP server and tricks or socially engineers a user into connecting to it using the Remote Desktop Client. When the user connects, the attacker exploits a use-after-free memory flaw in the client to inject and run malicious code on the victim's computer.
Prerequisites
- User must initiate a Remote Desktop Client connection
- Connection must be made to an attacker-controlled or compromised RDP server
- Affected version of Windows with Remote Desktop Client must be in use
remotely exploitableuser interaction requiredlow complexitydefault credentials not a factor
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict outbound network access to RDP servers (port 3389/TCP) to only authorized, known hosts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXInstall the October 2026 Windows security update on all Windows systems running affected versions (Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025)
Long-term hardening
0/1HARDENINGDisable Remote Desktop Client on systems that do not require RDP functionality
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/adc7470c-c3f0-45cf-a7c9-66276f3df973Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.