OTPulse

Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

Plan PatchCVSS 7.5CVE-2026-70033Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

What this means
What could happen
Could disrupt device operations or cause loss of view/control
Who's at risk
Organizations in critical infrastructure using Microsoft equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Windows Server 2022 (Server Core installation)All versionsBuild 10.0.20348.5761
Windows Server 2025 (Server Core installation)All versionsBuild 10.0.26100.33650
Windows Server 2025All versionsBuild 10.0.26100.33650
Remediation & Mitigation
0/1
Long-term hardening
0/1
Exploitation assessment: Exploitation Unlikely. Apply the 2026-Oct security update.
View full vendor advisory
API: /api/v1/advisories/70dc0246-49c6-4cd6-9d1e-4c844a478112

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.