Windows Remote Desktop Protocol Information Disclosure Vulnerability
Plan PatchCVSS 7.5CVE-2026-70587Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Improper null termination in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 on all supported architectures (32-bit, x64, ARM64). An attacker with network access to RDP can trigger the flaw without authentication, causing information leakage.
What this means
What could happen
An attacker on the network could exploit a flaw in Remote Desktop Protocol to view sensitive information transmitted during RDP sessions without authentication. This could expose credentials, session data, or other confidential information related to remote access to your systems.
Who's at risk
Any organization using Windows 10, Windows 11, or Windows Server 2016, 2019, 2022, or 2025 systems with Remote Desktop Protocol (RDP) enabled should be concerned. This includes systems used for remote administration, remote access workstations, and jump hosts in industrial or utility environments. If your PLCs, SCADA servers, or engineering workstations are remotely accessible via RDP, they are at risk of information disclosure.
How it could be exploited
An attacker with network access to a system running RDP (port 3389) can send a specially crafted RDP packet to trigger improper null termination in the protocol handler, causing the system to leak sensitive data in the response. No authentication is required.
Prerequisites
- Network access to port 3389 (RDP)
- RDP service enabled on the target system
- No authentication required
remotely exploitableno authentication requiredlow complexityinformation disclosure
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply Windows security update for September 2026 to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/9cbb0557-c9fe-4c60-a4cb-345ecaddcd50Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.