Microsoft has released security updates addressing CVE-2026-69485, an Important-rated remote code execution vulnerability affecting the Windows Remote Desktop Client. Disclosed on September 8, 2026, the vulnerability has a CVSS 3.1 score of high and a temporal score of high. The flaw exists because the Remote Desktop Client uses an uninitialized resource, which could allow an authenticated, low-privileged attacker to send a specially crafted network request and execute arbitrary code on an affected system.

Exploitation of CVE-2026-69485 could have significant confidentiality, integrity, and availability impacts. An attacker who successfully exploits the vulnerability could potentially access sensitive information, modify files or system configurations, install additional tools, or disrupt services, depending on the privileges of the compromised account. The attack requires network access, low attack complexity, and low privileges, but does not require user interaction, meaning exploitation does not depend on a victim clicking a link, opening a file, or approving a prompt.

Microsoft stated that the vulnerability was not publicly disclosed or exploited in the wild before the security update and currently rates exploitation as “Exploitation Less Likely.” However, organizations should prioritize remediation because public disclosure of technical vulnerability details can enable threat actors to analyze the flaw and develop exploit techniques. Affected products include Windows Server 2016, 2019, 2022, and 2025, including Server Core, as well as supported Windows 10 and Windows 11 editions, including Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1 on supported x64 and ARM64 systems.

Organizations should apply Microsoft’s September 2026 security updates promptly, including the applicable KB packages such as KB5123099, KB5122876, KB5122882, KB5122878, KB5122880, KB5124008, KB5124012, and KB5122871. Security teams should also review and minimize Remote Desktop exposure, restrict RDP access to trusted networks, enforce least-privilege access, and monitor authentication and Remote Desktop logs for suspicious activity. Microsoft credited Researcher for responsibly reporting the vulnerability through coordinated disclosure.