Remote Desktop Gateway Service Information Disclosure Vulnerability
MonitorCVSS 6.5CVE-2026-84007Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Out-of-bounds read vulnerability in Remote Desktop Gateway Service (CVE-2026-84007) allows an authorized attacker to disclose sensitive information from service memory over the network. Affects Windows Server 2016, 2019, 2022, and 2025 (all versions, including Server Core). Exploitation is considered unlikely but information disclosure could expose configuration details or session data. Vendor has released patches for all supported versions.
What this means
What could happen
An attacker with valid network access and credentials could read sensitive information from the Remote Desktop Gateway service memory, potentially exposing configuration details, session data, or other confidential system information.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025 as remote access or gateway servers should prioritize this update. This affects any facility using Remote Desktop Gateway for administrative or operational access, including water utilities and electric utilities managing SCADA systems remotely through Windows infrastructure.
How it could be exploited
An attacker with valid credentials connects to the Remote Desktop Gateway service over the network and sends specially crafted requests to trigger an out-of-bounds read in the service process, allowing them to retrieve sensitive data from memory.
Prerequisites
- Valid credentials to authenticate to the network or RD Gateway service
- Network access to the Remote Desktop Gateway service port
- RD Gateway service must be running and accessible
Requires valid credentialsLow exploit probabilityInformation disclosure only (no direct control)Affects centralized remote access infrastructure
Exploitability
Unlikely to be exploited — EPSS score 1.0%
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/6
Do now
0/1WORKAROUNDRestrict network access to Remote Desktop Gateway service ports to trusted administrative networks and devices only
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Long-term hardening
0/1HARDENINGEnforce multi-factor authentication for all Remote Desktop Gateway access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4c10561b-1ee5-4f4a-ae04-15998cf1bf6eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.