Remote Desktop Gateway CVE-2026-69292

Exploitation requires low-privilege authenticated access to the target Windows Server (PR:L, AV:L) - the attacker must be able to log on locally or run processes on the affected host. The Remote Desktop Gateway Service must be installed and actively running; this role is not present in default Windows Server installations and must be explicitly enabled by an administrator. High attack complexity (AC:H) means the attacker must craft a specific heap state, making reliable exploitation non-trivial and significantly reducing the likelihood of opportunistic or automated mass exploitation. The vulnerability does not affect Windows systems where the RD Gateway role is absent, and it does not permit remote unauthenticated exploitation.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the essential tension: successful exploitation yields a full three-way C:H/I:H/A:H impact, but the attacker must already have low-privilege local access and must overcome high attack complexity requiring careful heap manipulation. No EPSS data was provided, and the vulnerability does not appear in CISA KEV, indicating no confirmed mass exploitation at time of analysis. RD Gateway servers are high-value targets - they sit at the perimeter of corporate networks and typically run as elevated Windows services - so even a mid-sized municipal IT team in legnica operating exposed RD Gateway infrastructure should treat this as a near-term patch priority rather than defer it on complexity grounds. No public proof-of-concept exploit has been identified, and the AC:H rating makes opportunistic automated exploitation less likely in the near term.

An attacker who has obtained a low-privilege account on a Windows Server hosting the RD Gateway role interacts with the vulnerable service to trigger a double-free condition, corrupting heap memory structures in a controlled manner. After carefully grooming the heap to place attacker-controlled data at the freed allocation site, the attacker redirects the service's execution to shellcode or a ROP chain, ultimately running arbitrary code at SYSTEM-level privilege. No public exploit code has been identified at time of analysis, and the AC:H rating means reliable exploitation requires significant technical effort.