Microsoft Windows Server RD Gateway: Use-after-free allows privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Remote Desktop Gateway Service of Windows Server allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privilege account, and the attack complexity is rated high. Microsoft's CVSS base score is 7.5, and NVD has not yet completed its analysis.

Affected

• Windows Server 2016 and Server Core installation: 10.0.14393.0 before 10.0.14393.9688
• Windows Server 2019 and Server Core installation: 10.0.17763.0 before 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 before 10.0.20348.5870 (listed in the CVE record; not yet confirmed in the MSRC product tree)
• Windows Server 2025 and Server Core installation: 10.0.26100.0 before 10.0.26100.33822 (listed in the CVE record; not yet confirmed in the MSRC product tree)

Fixed in

• Windows Server 2016: November 10, 2026, KB5131291 (OS build 14393.9688)
• Windows Server 2019: November 2026 update KB5131085 (build 17763.9487), as listed on the Microsoft update page
• Windows Server 2022 and 2025: Unknown. The KB that fixes this CVE could not be confirmed.

Workaround

Unknown. No workaround is documented. Patching is the only documented fix.

Exploitation

• Microsoft lists the vulnerability as not publicly disclosed and not exploited.
• No public proof-of-concept code and no CISA KEV entry were found in a limited search. This does not confirm that no exploitation exists.

Our recommendation

• Apply the November 2026 security update to all affected Windows Server systems, especially servers with the RD Gateway role.
• Confirm the fixed build for Windows Server 2022 and 2025 in the MSRC Security Update Guide before relying on it.
• Review which accounts can reach the RD Gateway and enforce strong, unique passwords and MFA.
• Check whether RD Gateway is exposed to the internet and limit access where it is not needed.
• Review the other RD Gateway use-after-free vulnerabilities published in October 2026 in the same patch cycle.
• Plan the upgrade of Windows Server 2016 systems, as support ends in January 2027.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-80094 msrc.microsoft.com
• CVE Record CVE-2026-80094 (CVE.org) www.cve.org
• KB5131291 Windows 10 1607 / Windows Server 2016 security update support.microsoft.com
• Windows message center (release health) learn.microsoft.com
• Strix CVE-2026-80094 (third-party, not verified) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:12.