Vulnerabilities
Microsoft Remote Desktop Client RCE via Use‑After‑Free (CVE‑2026‑108458)
A use‑after‑free flaw in Windows Remote Desktop Client allows an unauthenticated network attacker to execute arbitrary code. The vulnerability affects all versions of the client that ship with Windows 10/11 and Windows Server 2019/2022. Apply the latest Microsoft security update and enforce RDP restrictions immediately.
What happened
Microsoft identified a use‑after‑free bug in the Remote Desktop Client that can be triggered by a crafted RDP session. An attacker who can establish an RDP connection to a target machine can cause the client to execute code with the privileges of the user who launched the client.
Impact
Unauthenticated attackers can gain remote code execution on any machine that accepts RDP connections, potentially leading to full system compromise, lateral movement, and data exfiltration.
Affected Versions
- Windows 10 21H2 and earlier
- Windows 11 21H2 and earlier
- Windows Server 2019 and 2022
Mitigation
- Install the Microsoft security update released on 2026‑08‑15 (KBxxxxxx).
- Restrict RDP access to trusted IP ranges and enforce Network Level Authentication.
- Enable Windows Defender Exploit Guard and set the RDP client to use the latest TLS protocol.
Related vulnerabilities
CVE-2026-61363: Remote Desktop Client Remote Code Execution Vulnerability
A critical RCE flaw in Windows Remote Desktop Client (CVE-2026-61363) allows attackers to execute arbitrary code via crafted RDP traffic. All Windows 10/11 and Windows Server 2022 systems are affected. Apply the latest security update and enforce NLA or VPN to mitigate.
Read briefing
Chromium CVE‑2026‑95356: Use‑After‑Free in WindowDialog
A use‑after‑free flaw in Chromium’s WindowDialog component (CVE‑2026‑95356) can enable arbitrary code execution via malicious web content. Microsoft Edge, which incorporates Chromium, is affected until the patch is applied. Defenders should update to the latest Edge release and monitor for anomalous browser activity.
Read briefing
CVE-2026-70274: Windows Bind Filter Driver Local Privilege Escalation
A use‑after‑free flaw in the Windows Bind Filter Driver allows an authenticated local user to elevate privileges. Microsoft has released a patch; defenders should apply it immediately and verify driver integrity.
Read briefing
CVE-2026-70014: Windows Cryptographic Services Remote Code Execution Exploit
Microsoft has identified a critical remote code execution flaw (CVE-2026-70014) in Windows Cryptographic Services that can be triggered by an authenticated attacker over the network. The use‑after‑free bug allows arbitrary code execution with service privileges on Windows 10, 11 and Server 2016‑2022. Apply the latest security update and restrict network access to mitigate the risk.
Read briefing