Microsoft September 2026 Updates Patch BitLocker Buffer Overflow (CVE-2026-69449) and Remote Desktop Client RCE (CVE-2026-69485)
Microsoft's September 2026 Patch Tuesday fixes two Important-rated Windows flaws: CVE-2026-69449, a CVSS 6.7 heap-based buffer overflow in BitLocker requiring privileged local access, and CVE-2026-69485, a CVSS 8.8 remote code execution flaw in the Remote…
Three reports published on 2026-09-09 describe vulnerabilities fixed in Microsoft's September 2026 Patch Tuesday cumulative updates. First, Microsoft disclosed CVE-2026-69449 on September 8, 2026: an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The sources describe the exploitation scope differently: one report says an authorized attacker could execute arbitrary code locally with possible in-network exploitation via arbitrary endpoint calls, while GBHackers states the attack vector is local (AV:L) with high privileges required and that remote exploitation over the internet is not possible — the sources disagree on whether in-network exploitation is possible, and neither report claims internet-facing remote execution in the vulnerability details. Microsoft rated exploitation as Less Likely and said there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core variants. Fixes shipped via platform-specific KBs such as KB5124012 and KB5122871; researchers from Hong Kong Polytechnic University, Huazhong University of Science and Technology, and Diffract were credited. Interim mitigations include least-privilege access, limiting administrative rights, monitoring for unexpected elevated process activity, and inventorying BitLocker-enabled systems. Second, Microsoft fixed CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1 base 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft said the flaw was not publicly disclosed before patching and rated exploitation as 'Less Likely' with no evidence of active exploitation. Affected products are Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882. The reports also urged defenders to restrict RDP exposure and monitor Remote Desktop authentication logs. Aside from the BitLocker exploitation-scope discrepancy, the reports do not conflict on stated facts; they describe separate flaws addressed in the same patch cycle.
- CVE-2026-69449: Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker, CVSS 3.1 base score 6.7, disclosed by Microsoft as CNA on September 8, 2026.
- CVE-2026-69449 exploitation scope: sources disagree — one describes local execution with possible in-network exploitation via arbitrary endpoint calls; GBHackers says the attack vector is local (AV:L) with high privileges required and…
- CVE-2026-69449 affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core variants.
- CVE-2026-69449 fixed via September 2026 Patch Tuesday cumulative updates, e.g. KB5124012 and KB5122871; Microsoft rated exploitation Less Likely with no public disclosure or in-the-wild exploitation at release.
- Interim mitigations for CVE-2026-69449: least-privilege access, limiting administrative rights, monitoring for unexpected elevated process activity, and inventorying BitLocker-enabled systems.
- Researchers from Hong Kong Polytechnic University, Huazhong University of Science and Technology, and Diffract were credited for the BitLocker flaw.
- CVE-2026-69485: Important-rated RCE (CVSS 3.1 base 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource.
- CVE-2026-69485 requires an authenticated low-privilege attacker sending a specially crafted network request; no user interaction is needed.
Coverage timelineoldest first · each row is one article
- · 6d agoWindows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely
Cyber Security News· 50
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.
- · 6d agoWindows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code
Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.
- · 6d agoWindows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems
GBHackers· 40
Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-69449 | Heap-Based Buffer Overflow in Windows BitLocker Enables Local Code Execution CVE-2026-69449 is a heap-based buffer overflow (CWE-122) in Microsoft's Windows BitLocker component that can be triggered by an authorized attacker operating locally, with no user interaction required. The CVSS vector (AV:L/AC:L/PR:H/UI:N) indicates exploitation requires the attacker to already hold high privileges, typically admin-level access, and yields high impact to confidentiality, integrity, and availability through code execution on the host. While some headlines describe remote code execution, Microsoft's description and scoring indicate a local attack surface, so the practical risk is code execution by an already-privileged local user, potentially undermining BitLocker's protection context. Any Windows edition or SKU that includes BitLocker is potentially affected, but Microsoft has not published specific affected version ranges in the data available here. No public proof-of-concept is known, the flaw is absent from the CISA KEV catalog, and EPSS assigns only a 0.4% probability of exploitation within 30 days, so exploitation has not been observed. Do: Apply the Windows security update addressing CVE-2026-69449 via Windows Update or WSUS as soon as Microsoft releases it, prioritizing shared workstations and servers where less-trusted users hold administrative rights. Since affected version ranges are not specified here, consult Microsoft's advisory for the definitive affected-product list before remediation, and monitor for workarounds if patching must be delayed. | 6.7 | <1% |
| masshundreds of millions of Windows devices (BitLocker is built into Windows Pro/Enterprise/Education) | ||
| CVE-2026-69485 | Use-of-Uninitialized-Resource RCE in Microsoft Windows Remote Desktop Client Microsoft's Windows Remote Desktop Client contains a use-of-uninitialized-resource flaw (CWE-908) that allows an authorized attacker to execute code over a network. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N), exploitation requires the attacker to hold some level of authorization (low privileges) but involves no user interaction and low attack complexity, occurring while the client processes network session data. Successful exploitation yields code execution with high impact on confidentiality, integrity, and availability on the system running the RDP client. Because the Remote Desktop Client ships by default with Windows desktop and server editions, any Windows system used to initiate Remote Desktop connections is potentially affected, though the available data does not specify affected version ranges. There is currently no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at just 0.9%. Do: Apply Microsoft's security update for CVE-2026-69485 as soon as it is published (monitor the MSRC advisory and the next Patch Tuesday); no fixed version number is provided in the available data. Until patched, restrict Remote Desktop client use to trusted RDP servers, require VPN or gateway access for RDP traffic, and keep Network Level Authentication enabled on RDP servers. Given the low EPSS score and absence of known exploitation, this can be prioritized within the normal cadence for high-severity Microsoft fixes rather than as an emergency. | 8.8 | <1% |
| masshundreds of millions of Windows endpoints (RDP client is bundled by default with Windows 10/11 and Windows Server) |