Microsoft Fixes Remote Code Execution Flaw in Windows Remote Desktop Client
Microsoft has addressed a remote code execution vulnerability in the Windows Remote Desktop Client tracked as CVE-2026-69485 with a CVSS score of 8.8. The flaw stems from the use of an uninitialized resource and can be triggered by a specially crafted network request from an authenticated attacker with low privileges. Exploitation requires no user interaction such as clicking links or opening files and can lead to information disclosure, file modification, or service disruption. Multiple versions of Windows 10, Windows 11, and Windows Server 2016 through 2025 are affected, including Server Core installations. The issue was not publicly disclosed prior to patching and no active exploitation has been observed. Fixes were released in the September security updates including KB5124008 and KB5122871.
BoletimSecSep 10, 2026Translated from Portuguese