Windows Remote Desktop Services Elevation of Privilege Vulnerability
Plan PatchCVSS 8.8CVE-2026-80096Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Windows Remote Desktop Services contains an out-of-bounds read vulnerability that allows an authorized attacker to elevate privileges over a network.
What this means
What could happen
A user with valid RDP login credentials could exploit this flaw to gain higher privileges on the system, potentially allowing them to modify system configurations, access sensitive data, or disrupt operations on critical servers.
Who's at risk
Windows Server administrators managing 2016, 2019, 2022, or 2025 deployments should prioritize this. Windows 10 and 11 systems used as remote access targets (including those accessed by field technicians for ICS configuration) are also affected. Any organization relying on RDP for remote access to critical systems or HMI servers should treat this as a priority.
How it could be exploited
An attacker with valid RDP credentials connects to a Windows system running a vulnerable version of Remote Desktop Services. The attacker sends a specially crafted RDP request that triggers an out-of-bounds memory read, allowing privilege escalation on the target system without requiring administrative approval or additional authentication.
Prerequisites
- Valid RDP user credentials
- Network access to port 3389 (or the RDP listening port if non-standard)
- Vulnerable Windows version with unpatched Remote Desktop Services
remotely exploitablelow complexityrequires valid credentialsaffects Windows servers and workstations
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict RDP access (port 3389) at the network firewall to only trusted administrative networks or use VPN with multi-factor authentication for RDP connections
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the 2026-September security update for your Windows Server and Windows 10/11 versions as listed in the affected products table (e.g., Build 10.0.17763.9245 for Server 2019, Build 10.0.20348.5622 for Server 2022)
Long-term hardening
0/1HARDENINGDisable RDP on systems that do not require remote access, or move to conditional access controls (RDP Gateway, Windows Defender Application Guard) for critical systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/23858519-3d12-47f1-b4c5-285410fd9691Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.