Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-83688Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Heap-based buffer overflow in Remote Desktop Client allows an attacker to execute arbitrary code on a Windows system over a network by sending a specially crafted message to the RDP client.
What this means
What could happen
An attacker could run arbitrary code on engineering workstations or HMI systems that use Remote Desktop Client, potentially compromising access to industrial control systems and process networks.
Who's at risk
Organizations operating Windows 10, Windows 11, Windows Server 2016, 2019, 2022, or 2025 systems used for remote access to industrial networks, engineering workstations, and human-machine interfaces (HMIs). Water authorities and utilities with remote desktop access to SCADA systems, PLCs, or historian servers are at risk.
How it could be exploited
An attacker sends a specially crafted message to the RDP client running on a targeted Windows system. If the user accepts the connection, the buffer overflow is triggered and arbitrary code executes with the privileges of the logged-in user.
Prerequisites
- User must accept an RDP connection from the attacker
- Vulnerable Remote Desktop Client software running on Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025
- Network reachability to the RDP client (port 3389 by default, or port forwarding/VPN access if internal)
remotely exploitableuser interaction required (RDP connection acceptance)low complexityaffects Windows workstations and servers used for OT access
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (28)
28 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict RDP access to trusted network segments only using Windows Defender Firewall or network firewall rules; block RDP (port 3389) from untrusted networks
WORKAROUNDDisable RDP on systems that do not require it for remote management
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 Windows security update to all systems running Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025
Long-term hardening
0/1HARDENINGRequire multi-factor authentication (MFA) for all RDP connections to critical systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/139699dc-54c1-49b7-8ec6-82f8d8151be2Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.