Windows Remote Desktop Services: Use-after-free in Remote Desktop Gateway Service

Summary

A use-after-free flaw in the Remote Desktop Gateway Service of Windows Server Remote Desktop Services allows an attacker to execute code on the affected server. The CVE record describes a local attack that requires an authorized, low-privileged account on the server, with high attack complexity and no user interaction. Microsoft's official title calls it a Remote Code Execution vulnerability, but the description and CVSS vector (AV:L) indicate a local attack. The CVSS score is 7.0 (High), and the CVE is not yet analysed by NVD.

Affected

• Windows Server 2016 and Server Core installation: 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870 (listed in the CVE record, verify on MSRC)
• Windows Server 2025 and Server Core installation: 10.0.26100.0 to before 10.0.26100.33822 (listed in the CVE record, verify on MSRC)

Fixed in

• Fixed builds per the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.20348.5870, 10.0.26100.33822 and later
• Exact KB numbers per Windows version: Unknown. Check the MSRC advisory.

Workaround

Unknown.

Exploitation

• Microsoft's advisory data marks the flaw as not exploited and not publicly disclosed, with exploitability rated 'Exploitation Less Likely'.
• CISA SSVC lists exploitation as 'none' and automatable as 'no'.
• No public proof of concept found. KEV listing not verified directly.

Our recommendation

• Install the Microsoft security update for the affected Windows Server version on servers running the Remote Desktop Gateway role, starting with those reachable from the internet.
• Test the update on a non-production host first, because a third-party report describes Remote Desktop Services disconnect problems after recent cumulative updates.
• Limit local logons to trusted administrators and review accounts on RD Gateway hosts.
• Check the KEV catalog and NVD for updates on this CVE.
• Priority is medium to high for SMEs that publish RD Gateway, and lower for servers without it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69565 msrc.microsoft.com
• CVE Record: CVE-2026-69565 www.cve.org
• Microsoft Learn: Remote Desktop Services roles learn.microsoft.com
• Strix: CVE-2026-69565 (third-party mirror, unverified) www.strix.ai
• CISA Known Exploited Vulnerabilities catalog bulletin www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:16.