A remote code execution vulnerability, tracked as CVE-2026-69485 with a CVSS score of 8.8, affects the Windows Remote Desktop Client, allowing an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request. The flaw stems from the Remote Desktop Client using an uninitialized resource, which can cause software to use memory, handles, or other system objects before they are properly prepared. This vulnerability has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. An attacker may trigger the faulty condition through a crafted network request and gain the ability to run code. Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems, affecting the targeted device’s confidentiality, integrity, and availability. Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services. Microsoft has released security updates for this vulnerability, which affects various Windows Server and client editions, including Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems. Administrators should deploy Microsoft’s September security updates as soon as possible to mitigate this vulnerability.
We recommend you to update Windows Remote Desktop Client to given version link: https://cybersecuritynews.com/windows-remote-desktop-client-rce-vulnerability/[/subscribe_to_unlock_form]
A remote code execution vulnerability, tracked as CVE-2026-69485 with a CVSS score of 8.8, affects the Windows Remote Desktop Client, allowing an authenticated attacker with low privileges to execute code on an affected server by sending a specially crafted network request. The flaw stems from the Remote Desktop Client using an uninitialized resource, which can cause software to use memory, handles, or other system objects before they are properly prepared. This vulnerability has a network attack vector, low attack complexity, requires low privileges, and does not need user interaction. An attacker may trigger the faulty condition through a crafted network request and gain the ability to run code. Remote code execution flaws are highly significant because they can give attackers control over vulnerable systems, affecting the targeted device’s confidentiality, integrity, and availability. Depending on the permissions available to the compromised account, an attacker could access sensitive data, modify files or system settings, install additional tools, or disrupt services. Microsoft has released security updates for this vulnerability, which affects various Windows Server and client editions, including Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for supported x64 and ARM64 systems. Administrators should deploy Microsoft’s September security updates as soon as possible to mitigate this vulnerability.
We recommend you to update Windows Remote Desktop Client to given version link: https://cybersecuritynews.com/windows-remote-desktop-client-rce-vulnerability/[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]