Remote Desktop Client Remote Code Execution Vulnerability
Plan PatchCVSS 8.8CVE-2026-83998Sep 8, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
Heap-based buffer overflow in Remote Desktop Client allows an attacker to execute code over a network. The vulnerability affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems across multiple architectures.
What this means
What could happen
An attacker could remotely execute arbitrary code on engineering workstations or HMI systems running Remote Desktop Client, potentially gaining control over connected industrial equipment or SCADA interfaces.
Who's at risk
Engineering workstations, HMI (Human-Machine Interface) terminals, and administrative consoles that use Remote Desktop Client to access SCADA systems, PLCs, or remote facilities. This includes Windows 10/11 workstations and Windows Server systems used for industrial monitoring or control in water utilities, electric utilities, and manufacturing plants.
How it could be exploited
An attacker sends a malicious Remote Desktop Protocol (RDP) message to a system running vulnerable Remote Desktop Client. The crafted message exploits a heap buffer overflow, allowing code execution without user authentication. This could be delivered through a compromised RDP server or network-in-the-middle position.
Prerequisites
- Network access to port 3389 (RDP) or Remote Desktop Client connectivity to an attacker-controlled RDP server
- User action: victim must connect to an attacker-controlled RDP server or receive RDP connection from attacker
remotely exploitablelow complexityno authentication required at network levelaffects remote access tools used by industrial operators
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to RDP (port 3389) using firewall rules—allow only from trusted engineering networks and administrative subnets
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply Microsoft 2026-Sep security update to all Windows 10, Windows 11, and Windows Server systems running Remote Desktop Client
Long-term hardening
0/2HARDENINGDisable RDP on systems where remote access is not required, particularly non-critical workstations
HARDENINGDeploy VPN or bastion host requirements for any remote access to industrial systems; do not expose RDP directly to untrusted networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/00d6f736-8bd6-4a1e-bd91-e2a4c9970482Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.