CVE-2026-69485

Microsoft's Windows Remote Desktop Client contains a use-of-uninitialized-resource flaw (CWE-908) that allows an authorized attacker to execute code over a network. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation requires the attacker to hold some level of authorization (low privileges) but involves no user interaction and low attack complexity, occurring while the client processes network session data. Successful exploitation yields code execution with high impact on confidentiality, integrity, and availability on the system running the RDP client. Because the Remote Desktop Client ships by default with Windows desktop and server editions, any Windows system used to initiate Remote Desktop connections is potentially affected, though the available data does not specify affected version ranges. There is currently no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at just 0.9%.

What to do: Apply Microsoft's security update for CVE-2026-69485 as soon as it is published (monitor the MSRC advisory and the next Patch Tuesday); no fixed version number is provided in the available data. Until patched, restrict Remote Desktop client use to trusted RDP servers, require VPN or gateway access for RDP traffic, and keep Network Level Authentication enabled on RDP servers. Given the low EPSS score and absence of known exploitation, this can be prioritized within the normal cadence for high-severity Microsoft fixes rather than as an emergency.