Windows Remote Desktop Client Denial of Service Vulnerability
MonitorCVSS 6.5CVE-2026-77896Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Integer overflow or wraparound in the Remote Desktop Client allows an unauthorized attacker to cause a denial of service over a network. The vulnerability is present in Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across all supported architectures (32-bit, x64, ARM64, and Server Core installations).
What this means
What could happen
An attacker could force the Remote Desktop Client to crash or become unresponsive by sending a specially crafted network packet, interrupting remote connections to critical systems like HMIs or engineering workstations.
Who's at risk
Water utilities and municipal electric departments that rely on Remote Desktop Client to manage HMIs, SCADA systems, or engineering workstations running Windows 10 or Windows Server 2016, 2019, 2022, or 2025. Any operator using RDP to access plant control systems remotely is affected.
How it could be exploited
An attacker sends a malicious RDP protocol packet containing an integer overflow to a Windows system running Remote Desktop Client. The client processes the packet and crashes due to the integer wraparound, causing denial of service. The attack requires network access to port 3389 (or the RDP service port) and no authentication.
Prerequisites
- Network access to RDP service port (typically port 3389)
- No authentication required
- Target system has Remote Desktop Client installed and listening
remotely exploitableno authentication requiredlow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.7%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to RDP ports (typically port 3389) using firewall rules to only allow connections from trusted engineering networks or VPN
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the September 2026 Windows security update for your affected OS version (Build 10.0.17763.9245 for Server 2019; 10.0.20348.5622 for Server 2022; 10.0.26100.33438 for Server 2025; or corresponding Windows 10/11 builds)
Long-term hardening
0/1HARDENINGDisable RDP on systems that do not require remote access, or move RDP services behind a VPN gateway
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/64458ea5-eaeb-4f92-a8cb-4468a04a74dbGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.