Windows Remote Desktop Services Remote Code Execution Vulnerability
Plan PatchCVSS 8.1CVE-2026-70187Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
Use-after-free vulnerability in the Remote Desktop Gateway Service allows unauthorized network attackers to execute code remotely. The flaw exists in memory management within RD Gateway and does not require authentication or user interaction. Affects Windows Server 2016, 2019, 2022, and 2025 in both standard and Server Core installations.
What this means
What could happen
An attacker on the network could trigger a use-after-free vulnerability in Remote Desktop Gateway to run commands on your Windows Server with high privileges, potentially taking control of the system or disrupting services that depend on it.
Who's at risk
Windows Server administrators running Remote Desktop Gateway services, especially those used for remote access management in utility/critical infrastructure environments. Affects Windows Server 2016, 2019, 2022, and 2025 deployments.
How it could be exploited
An attacker sends a specially crafted network request to the Remote Desktop Gateway Service (RD Gateway) listening on the network. The use-after-free flaw allows the attacker to execute arbitrary code in the context of the Gateway service, which runs with system privileges.
Prerequisites
- Network access to the Remote Desktop Gateway Service (typically port 443 or 3388)
- RD Gateway service must be installed and running
remotely exploitableno authentication requiredhigh privilege executionaffects server infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/2WORKAROUNDIf RD Gateway is not required, disable or uninstall the Remote Desktop Gateway Service to eliminate the attack surface
HARDENINGRestrict network access to Remote Desktop Gateway ports (443, 3388) to only authorized management networks or specific trusted IP ranges using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXApply the October 2026 Windows security update to Windows Server 2019 (Build 10.0.17763.9376), Server 2022 (Build 10.0.20348.5761), Server 2025 (Build 10.0.26100.33650), or Server 2016 (Build 10.0.14393.9612)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/73441ef2-01b3-4855-bb42-06bf3a868967Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.