Remote Desktop Gateway CVE-2026-69338

The attacker must hold valid credentials sufficient for at least low-privilege network access to the RD Gateway service, as reflected by PR:L in the CVSS vector. The Remote Desktop Gateway role service must be installed and running on the target Windows Server host - servers without this role are not exposed. User interaction is required (UI:R), indicating the exploit depends on a concurrent authenticated session or a specific triggering action, rather than being fully autonomous. Additionally, the AC:H constraint means the attacker must satisfy specific timing or race conditions, preventing reliable one-shot exploitation. Systems running builds at or above the patched thresholds are not affected. Unauthenticated internet attackers cannot exploit this vulnerability without first acquiring valid credentials.

The CVSS 7.1 score reflects meaningful real-world constraints: while the attack vector is network (AV:N), high complexity (AC:H) and required user interaction (UI:R) significantly limit opportunistic mass exploitation - both conditions must align simultaneously with a valid credential (PR:L), ruling out anonymous internet-scale attack campaigns. Despite these constraints, the C:H/I:H/A:H impact metrics underscore the consequence of a successful exploit: full privilege escalation on the gateway host. No public exploit code has been identified, and CISA KEV status is absent, moderating urgency relative to confirmed in-the-wild flaws. EPSS data was not provided, so exploitation probability cannot be quantified beyond inferring from the AC:H/UI:R constraints that mass exploitation is unlikely in the short term. Even so, organizations running RD Gateway - including a mid-sized municipal IT team in opole - should treat this as a priority patch, given that RD Gateway services are commonly internet-exposed and privilege escalation on a gateway host carries substantial lateral movement potential into internal network segments.

An attacker with valid low-privilege domain or local credentials connects to an internet-exposed RD Gateway over HTTPS and issues a specially crafted RDP-over-HTTPS request designed to trigger a race condition in the gateway service's memory management - exploiting the use-after-free to redirect execution. If the timing conditions align (reflecting the AC:H/UI:R constraints, possibly requiring a concurrent legitimate session), the attacker achieves privilege escalation on the gateway host and can use that foothold to pivot laterally into protected internal network segments.