Microsoft Windows: Remote code execution in Remote Desktop Services

Summary

A double free vulnerability (CWE-415) in the Remote Desktop Gateway Service of Windows allows an unauthenticated remote attacker to execute code over the network. NVD rates it CVSS 3.1 8.1 (high), with high attack complexity and no privileges or user interaction required. Other sources rate it differently (VulDB 10.0). The risk is highest for internet-facing RD Gateway servers.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows Server 2012 and 2012 R2, including Server Core (builds before 6.2.9200.26434 and 6.3.9600.23470)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9612)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9376)
• Windows Server 2022 (builds before 10.0.20348.5761)
• Windows Server 2025, including Server Core (builds before 10.0.26100.33650)

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809 and Server 2019: 10.0.17763.9376
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650

The KB numbers per product must be confirmed in the MSRC advisory. The fix is part of the October 2026 cumulative update.

Workaround

Unknown. No Microsoft workaround was found in the sources reviewed.

• Restrict RD Gateway access to required users and networks, or place it behind a VPN or MFA-protected front end.
• Remove the RD Gateway role if it is not in use.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in the research; this does not rule one out.
• EPSS about 0.67%.

Our recommendation

• Patch affected systems with the October 2026 security update in the next regular maintenance window; prioritise internet-facing RD Gateway servers.
• Windows 10 1607 is out of normal support; if it is still in use, replace it or check whether a patch is available.
• Check whether the RD Gateway role is deployed; if not, remove it.
• Monitor RD Gateway logs for crashes or unusual connections.
• Verify the exact KB and build in the MSRC advisory before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-84012 msrc.microsoft.com
• NVD record via Vulners vulners.com
• OpenCVE: CVE-2026-84012 app.opencve.io
• VulDB: CVE-2026-84012 vuldb.com
• Strix: CVE-2026-84012 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:24.