Microsoft RDP Client Has an 8.8 RCE. The Victim Does Not Need to Click

• The Mess: Microsoft patched a high-severity RCE in Remote Desktop Client caused by use of an uninitialized resource. A low-privileged attacker can trigger the flaw remotely.
• The Damage: CVE-2026-69485 can turn an authorized network connection into code execution on the machine running the RDP client.
• The Fix: Install Microsoft’s September 2026 security updates and verify that every managed Windows endpoint has received the corrected RDP Client build.

Remote Desktop is usually treated as the thing you use to reach another machine.

CVE-2026-69485 flips the perspective.

The vulnerable component is the Remote Desktop Client itself.

Microsoft describes the flaw as a use of uninitialized resource vulnerability that allows an authorized attacker to execute code over a network. The vulnerability carries a CVSS 8.8 score.

The client is the attack surface

This is not a vulnerability in an RDP server waiting for random Internet scans.

The affected component is the client used by Windows systems to establish Remote Desktop connections.

The attack vector is therefore interesting:

attacker-controlled network interaction → vulnerable RDP client → code execution

The CVSS vector is:

AV:N / AC:L / PR:L / UI:N / S:U / C:H / I:H / A:H

In plain English: the attacker needs low privileges, but does not need the victim to click anything once the vulnerable interaction is established.

That makes the bug considerably more interesting than a conventional local privilege-escalation flaw.

The bug is memory-management territory

CVE-2026-69485 is classified as CWE-908: Use of Uninitialized Resource.

Microsoft’s public description is deliberately sparse, so there is no responsible reason to invent a detailed exploitation primitive that Microsoft has not published.

What we do know is enough:

The RDP client can consume a resource before it has been properly initialized.

An attacker who can reach the vulnerable code path can manipulate that state into code execution.

The resulting impact is rated high across confidentiality, integrity and availability.

Windows 10 and 11 are affected

The vulnerability isn’t limited to one forgotten Windows release.

Affected products include multiple versions of:

• Windows 10
• Windows 11
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Microsoft released fixes across those branches in the September security updates.

For example, Windows 11 24H2 is fixed at build 10.0.26100.9445, while Windows 11 25H2 is fixed at 10.0.26200.9445. Windows Server 2025 is fixed at 10.0.26100.33438.

The exact build matters.

“Windows Update ran yesterday” isn’t a vulnerability assessment.

This isn’t the same as an RDP server bug

That distinction deserves emphasis.

If an attacker exploits an RDP server, the target is the machine accepting incoming Remote Desktop connections.

Here, the vulnerable software is the client.

That changes the defensive question.

Don’t just ask:

“Which machines expose RDP?”

Ask:

“Which machines run Remote Desktop Client and connect to systems we don’t completely control?”

That includes administrator workstations, jump boxes, support machines and potentially servers used to initiate outbound RDP sessions.

The privilege requirement reduces the blast radius — not the risk

CVE-2026-69485 requires low privileges.

That is significant.

An attacker doesn’t appear to be able to simply send one packet to an arbitrary Windows machine and instantly obtain code execution.

There has to be an authorized attack context.

But once an attacker already has a low-privileged foothold, remote code execution in a client component is exactly the sort of capability that can turn a limited compromise into something much larger.

And there is no user-interaction requirement in the CVSS vector.

No active exploitation reported

Unlike the two Windows zero-days from Microsoft’s September release, CVE-2026-69485 is not currently presented as an exploited-in-the-wild vulnerability.

It was publicly assigned and disclosed on September 8, 2026, and Microsoft has already shipped fixes.

That distinction matters.

There is no reason to call this another Windows zero-day.

There is every reason to patch it.

Especially because RDP is one of those technologies that defenders tend to deploy everywhere and then forget about the client side.

Bugstoday Opinion

RDP bugs usually get attention when someone can attack an exposed Windows server.

This one is more interesting.

The vulnerable component is sitting on the other side of the connection.

The RDP client is trusted because it is supposed to connect to trusted infrastructure.

CVE-2026-69485 reminds us that the connection itself can become the attack surface.

No public exploit.

No confirmed active exploitation.

But an 8.8 RCE in a Windows networking client is not something to leave sitting around while attackers start reading the patch.

Patch the client, not just the server.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• Microsoft Security Response Center — CVE-2026-69485, Remote Desktop Client Remote Code Execution Vulnerability
• NVD / CVE — CVE-2026-69485
• Zero Day Initiative — September 2026 Microsoft Security Update Review
• EUVD — EUVD-2026-72983 / CVE-2026-69485