Microsoft disclosed a use-after-free flaw in Windows Remote Desktop Services, scored CVSS 9.8, that lets an unauthorized attacker execute code over a network against a broad range of Windows client and server builds.
What Is It
CVE-2026-69525 is a use-after-free vulnerability in Windows Remote Desktop Services. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability.
The CVE was published 2026-09-08 by Microsoft ([email protected]) and is currently in "Awaiting Analysis" status at NVD.
Why It Matters
The metric combination here is the worst case for a remote service: an unauthenticated attacker reaching an exposed RDS endpoint can achieve code execution with no user in the loop. Remote Desktop Services is routinely internet-facing or reachable across flat internal networks, which makes the exposed population large and the path from initial access to full system compromise short.
Note: no CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation and no KEV-mandated remediation deadline in the source material at this time.
What's Vulnerable
Microsoft lists affected builds across the Windows client and server lines:
- Windows 10: 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 and 22H2 (< 10.0.19044.7725 / 10.0.19045.7725)
- Windows 11: 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server: 2012 (< 6.2.9200.26349), 2012 R2 (< 6.3.9600.23397), 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025 (10.0.26100 branch; confirm the fixed revision in MSRC)
One note on the server line: Windows Server 2025 and Windows 11 24H2 ship from the same 10.0.26100 branch, and servicing revisions on a shared branch normally track together, which puts the Server 2025 fix on the same 10.0.26100 revision line as 24H2. Administrators patching Server 2025 should confirm the exact fixed revision against the MSRC entry before validating their build numbers.
Server Core installations of 2012, 2012 R2, 2016, 2019, and 2025 are affected on the same builds. Platforms span 32-bit, x64, and ARM64 systems depending on the release.
Patch Status
Microsoft has published fixed build numbers for the affected products, listed above. Patch to at or above the fixed build for your release via the MSRC update guide entry, verifying the target revision there for Windows Server 2025.
Sources
- Microsoft MSRC Update Guide; CVE-2026-69525: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69525
- NVD, CVE-2026-69525: https://nvd.nist.gov/vuln/detail/CVE-2026-69525