CVE-2026-69525

Remote Desktop Services Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Windows Remote Desktop Services (RDP) and identify your exact Windows version and build number (e.g., “Windows 10” or “Windows Server 2019” plus the build).
Compare your build to the fixed versions below; if you are on an affected build, plan an immediate update to a fixed build.
Apply the available Windows updates that move you to at least the fixed build for your exact product/branch:
- Windows 10: update to 10.0.14393.9512, or 10.0.17763.9245, or 10.0.19044.7725, or 10.0.19045.7725
- Windows 11: update to 10.0.22631.7582, or 10.0.26100.9445, or 10.0.26200.9445, or 10.0.28000.2954
- Windows Server 2012: update to 6.2.9200.26349
- Windows Server 2012 R2: update to 6.3.9600.23397
- Windows Server 2016: update to 10.0.14393.9512
After updating, confirm the build number changed and that Remote Desktop Services continues to run as expected; then re-test any remote-access workflows you rely on.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

This Windows Remote Desktop Services bug can let an attacker run code over the network, even without you clicking anything—so most small businesses using remote desktop should treat it as urgent and patch now.

CVE-2026-69525 is a remote-code-execution issue in Windows Remote Desktop Services caused by a use-after-free weakness, allowing unauthenticated network attackers to trigger the fault and execute code.

If you're affected

Full server takeover
Stop working / service disruption
Theft of sensitive data
Ransomware risk

What is it

Remote Desktop Services is the Windows feature that allows computers to be accessed from the network. This vulnerability is like a “memory management mistake” that can be tricked by a remote attacker, potentially letting them run their own code on your machine. If your RDP service is reachable, it can turn a simple network connection into a full compromise.

Who is affected

This matters if you use or host Remote Desktop Services on any of these systems: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows Server 2025. Your risk is mainly about exposure: it’s a concern if Remote Desktop Services is reachable from the network (for example, accessible from the internet or from an untrusted network).

How urgent is it

This is a RED item because it is a remote-code-execution vulnerability in a widely used remote-access component. Even though there’s no KEV listing and no public exploit code on record, attackers only need to find a working path once—patching is the fastest way to remove that path.

What to do — in detail

Confirm whether we’re exposed

On each affected server/PC, determine the exact OS edition and build number.
- For example, capture: “Windows 10/11/Windows Server” and the detailed build (the build number is what you will compare to the fixed versions below).
Determine whether Remote Desktop Services / RDP is enabled and reachable.
- Check if RDP is turned on, and whether port access exists from outside trusted networks.
- Focus on systems where RDP is used for administration.

Check against fixed versions

Windows 10 is fixed in: 10.0.14393.9512, 10.0.17763.9245, 10.0.19044.7725, or 10.0.19045.7725.
Windows 11 is fixed in: 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954.
Windows Server 2012 is fixed in: 6.2.9200.26349.
Windows Server 2012 R2 is fixed in: 6.3.9600.23397.
Windows Server 2016 is fixed in: 10.0.14393.9512.

(If your build is lower than the listed fixed build for your specific OS line, treat it as still vulnerable and update.)

Upgrade / patch plan

Apply the Microsoft security updates that correspond to the fixed build for your exact OS.
Reboot if required and verify the build number after installation.
Validate RDP functionality after patching (so you don’t accidentally leave the service broken while also leaving it unpatched).

If patching is delayed (temporary risk reduction)

Reduce exposure immediately by restricting network access to RDP to trusted management networks only (for example, allowlist known admin IPs/subnets) and ensure the RDP service is not reachable from the internet.
Monitor access attempts around the RDP service (failed logins, unusual source IPs) while patching is pending.

Findings context to guide monitoring

CISA KEV does not list this vulnerability, and there is no public exploit code on record.
However, the weakness is remote code execution in Remote Desktop Services, so you should treat it as actively important and patch promptly.

What to monitor after update

RDP service health and authentication logs for unusual activity.
Any unexpected crashes/restarts of Remote Desktop Services after changes.

Technical context

CVE-2026-69525 is a Windows Remote Desktop Services remote code execution vulnerability driven by a use-after-free (CWE-416) memory-safety flaw. The expected outcome is that an attacker can trigger the vulnerable condition over the network and then execute code.

Operationally, this is high-risk because the service is designed for network accessibility and can be reachable without requiring user interaction. The inputs provided indicate the issue is network-triggerable (attack over the network) with no user interaction requirement.

Patch availability is confirmed in the findings via multiple fixed build numbers for each impacted Windows line (Windows 10/11 and specific Windows Server versions listed). No CISA KEV entry and no public exploit code on record were found in the provided findings, so exploitation maturity is not confirmed here; nonetheless, the traffic-light verdict for this CVE is RED, and the appropriate response is rapid patching.

KEV not listed means CISA has not yet flagged it as known exploited in the wild (based on this dataset), and EPSS here is only predicted—findings do not override the need to patch.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-14Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable