CVE-2026-70187 – Windows Remote Desktop Services Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Windows Remote Desktop Services, specifically affecting the Remote Desktop Gateway Service. The vulnerability, identified as CVE-2026-70187, allows an unauthenticated attacker to potentially execute malicious code on an affected system by sending specially crafted network packets. The vulnerability is caused by a Use-After-Free memory handling flaw and can be exploited remotely without requiring user credentials or user interaction. Although exploitation is considered less likely due to its high attack complexity, successful exploitation could compromise the confidentiality, integrity, and availability of affected systems. Microsoft has released security updates to address this vulnerability.

CVSS SCORE: 8.1 (High)

SEVERITY: Critical

Threat

This vulnerability presents a significant security risk to organizations running affected Windows systems with Remote Desktop Gateway Services.

An attacker could exploit the vulnerability remotely over a network without authentication or user interaction.

Successful exploitation could allow an attacker to execute malicious code on the targeted system, potentially resulting in unauthorized access, sensitive information exposure, system compromise, and service disruption.

The vulnerability has a CVSS base score of 8.1, with High impact ratings across confidentiality, integrity, and availability.

Although the attack requires advanced technical knowledge and specific conditions, the potential consequences make this a serious security concern.

Exploits

Microsoft has classified this vulnerability as Exploitation Less Likely.

At the time of publication:

• Publicly Disclosed: No
• Actively Exploited: No
• Exploit Code Maturity: Unproven

There is no confirmed evidence of active exploitation or publicly available proof-of-concept (PoC) exploit code.

The vulnerability is not identified as a publicly disclosed zero-day.

However, the absence of known exploitation does not eliminate the risk of future attacks.

Because the vulnerability can potentially be exploited remotely without authentication, organizations should prioritize installing the security update before attackers develop reliable exploitation techniques.

Technical Summary

CVE-2026-70187 is a Use-After-Free (CWE-416) vulnerability affecting the Windows Remote Desktop Gateway Service.

A Use-After-Free vulnerability occurs when software attempts to access memory after that memory has already been released.

This memory management weakness can cause unexpected application behavior, memory corruption, or potentially allow an attacker to execute malicious code.

In this case, an unauthenticated attacker could send a specially crafted network packet to the affected Remote Desktop Gateway Service.

If the packet successfully triggers the memory handling flaw, the attacker could potentially execute code on the targeted system.

The vulnerability has the following technical characteristics:

• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The High attack complexity indicates that successful exploitation requires a deep understanding of the affected system and depends on specific conditions, including system configuration and existing security controls.

Exploitation is therefore not guaranteed.

However, successful exploitation could give an attacker the ability to run malicious code on a vulnerable system, potentially compromising sensitive information, modifying system resources, or disrupting critical services.

Exploitability

The vulnerability affects several Microsoft Windows operating systems, including:

• Windows 10: Versions 1607 and 1809
• Windows Server 2012 and 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Affected Windows Server versions include Server Core installations.

An unauthenticated attacker could attempt exploitation by sending a specially crafted network packet to the vulnerable Remote Desktop Gateway Service.

No privileges or user interaction are required.

However, exploitation requires high attack complexity, making successful attacks less likely.

Business Impact

This vulnerability could create serious security and operational risks for organizations that rely on Windows Remote Desktop Services for remote connectivity.

Remote Desktop Gateway Services are particularly important because they can provide remote access to internal business systems.

If an attacker successfully exploits this vulnerability, the consequences could include:

• Unauthorized System Access: Attackers could execute malicious code on vulnerable systems without requiring valid credentials.
• Sensitive Data Exposure: Successful exploitation could compromise confidential business information and other sensitive data.
• Operational Disruption: Compromised systems could experience service interruptions, potentially affecting employees and business operations.
• System Integrity Compromise: Attackers could potentially modify system resources or interfere with normal system operations.
• Financial and Reputational Damage: Security incidents involving critical infrastructure could result in recovery costs, downtime, and reduced customer confidence.

The vulnerability is particularly concerning because attackers do not need authentication or assistance from legitimate users to attempt exploitation.

A successful attack could turn a trusted remote access service into a security weakness that threatens the wider business environment.

Although exploitation is currently considered less likely, organizations should not underestimate the potential impact of a successful attack.

Workaround

Microsoft has not identified any official workarounds or mitigations for this vulnerability.

Organizations unable to deploy the patch immediately should consider temporary risk-reduction measures:

• Restrict network access to Remote Desktop Gateway Services to trusted networks and authorized sources.
• Limit external exposure of affected services wherever operationally possible.
• Disable Remote Desktop Gateway Services where they are not required.
• Monitor affected systems for unusual network activity and suspicious behavior.

These measures may reduce exposure but do not eliminate the underlying vulnerability.

Installing the official Microsoft security update remains the recommended remediation.

Urgency

Critical Severity – Prioritize Patch Deployment

CVE-2026-70187 should be prioritized for deployment because it affects Windows Remote Desktop Gateway Services and could allow unauthenticated remote code execution.

The vulnerability presents several important security concerns:

• Critical Severity: Microsoft has classified the vulnerability as Critical, with a CVSS base score of 8.1.
• Remote Attack Capability: Attackers could potentially exploit the vulnerability over a network.
• No Authentication Required: Attackers do not need valid user credentials.
• No User Interaction Required: Exploitation does not depend on users opening files, clicking links, or performing other actions.
• High Potential Impact: Successful exploitation could compromise system confidentiality, integrity, and availability.

Although Microsoft considers exploitation less likely and no active exploitation has been reported, delaying the patch could leave affected systems exposed to future attacks.

Organizations should prioritize systems running Remote Desktop Gateway Services, particularly those accessible from external networks.

Microsoft has released security updates for affected Windows versions, including:

• KB5126868: Windows 10 Version 1607 and Windows Server 2016
• KB5126651: Windows 10 Version 1809 and Windows Server 2019
• KB5126835: Windows Server 2012
• KB5126836: Windows Server 2012 R2
• KB5126655: Windows Server 2022
• KB5126646: Windows Server 2025

A system restart is required after installing the applicable security update.

Organizations should schedule deployment according to their critical patch management procedures, giving priority to systems with greater network exposure.

Early patching can prevent a remote access vulnerability from becoming a serious business security incident.