CVE-2025-30394

CVE-2025-30394 is a denial-of-service flaw in the Remote Desktop Gateway (RD Gateway) Service on Windows Server, caused by sensitive data being stored in improperly locked memory (CWE-591) in combination with a race condition (CWE-362). A remote, unauthenticated attacker can trigger it by sending crafted traffic to a network-exposed RD Gateway endpoint (typically TCP 443); the high attack complexity means the attacker must win a timing-sensitive race for the crash to occur. Successful exploitation makes the RD Gateway service fail or stop responding, interrupting remote access for users connecting through the gateway, with no confidentiality or integrity impact. Only servers running the RD Gateway role on Windows Server 2012, 2016, 2019, 2022, 2022 23H2, or 2025 are affected. There is currently no known in-the-wild exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV, but EPSS assigns a 30.5% (98th percentile) probability of exploitation within 30 days.

What to do: Apply Microsoft's security updates for all listed Windows Server versions, prioritizing any RD Gateway server exposed to the internet. Until patched, restrict TCP 443 access to the gateway (firewall allowlists or VPN-only access) and alert on RD Gateway service crashes or unexpected restarts. The high attack complexity makes opportunistic mass exploitation less likely, but the elevated EPSS (~31% within 30 days) justifies prompt patching of internet-facing gateways.