Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code
Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.
Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.
- CVE-2026-69485 rated CVSS 8.8; RCE via uninitialized resource in the RDP client.
- Requires authenticated low-privilege access; no user interaction needed.
- No public disclosure or active exploitation observed at publication time.
- Fixes shipped in September 2026 updates for Windows 10, 11 and Server 2016-2025.
- Defenders urged to restrict RDP exposure and monitor Remote Desktop authentication logs.
- CVEs
- CVE-2026-69485
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69485 | Use-of-Uninitialized-Resource RCE in Microsoft Windows Remote Desktop Client | 8.8 | <1% |
From the original article
2 min read at cybersecuritynews.com
Microsoft has released security updates for CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client. The flaw could allow an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request. The vulnerability was disclosed on September 8, 2026, and is tracked as […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.