Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code
Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.
Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.
- CVE-2026-69485 rated CVSS 8.8; RCE via uninitialized resource in the RDP client.
- Requires authenticated low-privilege access; no user interaction needed.
- No public disclosure or active exploitation observed at publication time.
- Fixes shipped in September 2026 updates for Windows 10, 11 and Server 2016-2025.
- Defenders urged to restrict RDP exposure and monitor Remote Desktop authentication logs.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69485 | Use-of-Uninitialized-Resource RCE in Microsoft Windows Remote Desktop Client Microsoft's Windows Remote Desktop Client contains a use-of-uninitialized-resource flaw (CWE-908) that allows an authorized attacker to execute code over a network. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation requires the attacker to hold some level of authorization (low privileges) but involves no user interaction and low attack complexity, occurring while the client processes network session data. Successful exploitation yields code execution with high impact on confidentiality, integrity, and availability on the system running the RDP client. Because the Remote Desktop Client ships by default with Windows desktop and server editions, any Windows system used to initiate Remote Desktop connections is potentially affected, though the available data does not specify affected version ranges. There is currently no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at just 0.9%. Do: Apply Microsoft's security update for CVE-2026-69485 as soon as it is published (monitor the MSRC advisory and the next Patch Tuesday); no fixed version number is provided in the available data. Until patched, restrict Remote Desktop client use to trusted RDP servers, require VPN or gateway access for RDP traffic, and keep Network Level Authentication enabled on RDP servers. Given the low EPSS score and absence of known exploitation, this can be prioritized within the normal cadence for high-severity Microsoft fixes rather than as an emergency. | 8.8 | <1% |
| masshundreds of millions of Windows endpoints (RDP client is bundled by default with Windows 10/11 and Windows Server) |
Full article526 words · extracted from cybersecuritynews.com · click to collapse
Microsoft has released security updates for CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client.
The flaw could allow an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request.
The vulnerability was disclosed on September 8, 2026, and is tracked as CVE-2026-69485. Microsoft assigned it a CVSS 3.1 base score of 8.8, while the temporal score is 7.7.
The issue has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. Microsoft said the flaw stems from the Remote Desktop Client using an uninitialized resource.
Uninitialized resources can cause software to use memory, handles, or other system objects before they are properly prepared. In this case, an attacker may trigger the faulty condition through a crafted network request and gain the ability to run code.
Windows Remote Desktop Client Vulnerability
Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems. Successful exploitation could affect the targeted device’s confidentiality, integrity, and availability.
Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services.
According to Microsoft’s advisory, exploitation requires an attacker to first authenticate with low-level access to an affected server. The attacker could then send a specially crafted request to execute code on that server.
The attack does not require a user to click a link, open a file, or approve a prompt, reducing opportunities for defenders to stop it through user awareness controls alone.
Microsoft’s initial assessment states that the vulnerability was not publicly disclosed before the security update and has not been detected in active exploitation.
The company rates exploitation as “Exploitation Less Likely” at the time of publication. However, organizations should treat the finding as a priority because public patch releases can help threat actors study the vulnerability and develop working exploit techniques.
The affected products include Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including Server Core installations.
Microsoft also listed several Windows client editions, including Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems.
Administrators should deploy Microsoft’s September security updates as soon as possible.
| KB Update | Windows Version |
|---|---|
| KB5123099 | Windows Server 2016 / Windows 10 1607 |
| KB5122876 | Windows Server 2019 / Windows 10 1809 |
| KB5122882 | Windows Server 2022 |
| KB5122878 | Windows 10 21H2 / 22H2 |
| KB5122880 | Windows 11 23H2 |
| KB5124008 | Windows 11 24H2 / 25H2 |
| KB5124012 | Windows 11 26H1 |
| KB5122871 | Windows Server 2025 |
Security teams should also review Remote Desktop exposure, restrict RDP access to trusted networks, enforce least-privilege access, and monitor authentication and Remote Desktop logs for unusual activity. Microsoft credited security researchers yhw and txz for reporting the vulnerability through coordinated disclosure.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/windows-remote-desktop-client-rce-vulnerability/