Windows Remote Desktop Services CVE-2026-69539

Exploitation requires a low-privilege authenticated account on the target system or domain - the official description specifies an 'authorized attacker,' consistent with CVSS PR:L. The target must have Remote Desktop Services enabled and accessible over the network (default port TCP 3389). Attack complexity is rated High (AC:H), indicating that reliable exploitation requires achieving a specific memory state or race condition within the RDS pipeline, rather than simple deterministic triggering. Exploitation is constrained by: (1) mandatory pre-authentication with at least a low-privilege account, excluding unauthenticated mass-scanning attacks; (2) AC:H race-condition complexity, which reduces automatable exploitation likelihood; (3) RDP service network reachability - hosts with RDP restricted behind VPN, host-firewall rules, or jump-server architectures substantially reduce exposure. No special non-default Windows configuration is otherwise required beyond RDS being enabled, which is default on Windows Server SKUs.

The CVSS 7.5 score (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a meaningful but not trivially exploitable vulnerability: network reachability is required, a low-privilege authenticated credential is needed, and high attack complexity (likely a race condition) must be navigated. Full C:H/I:H/A:H impact means successful exploitation yields RCE with the privileges of the RDS service process. No EPSS data was provided; the AC:H complexity requirement makes automated, opportunistic mass exploitation less probable than for AC:L RDP flaws, but targeted exploitation by skilled actors is plausible. There is no KEV listing and no POC has been identified, moderating near-term risk further. However, the breadth of affected platforms - 19 distinct Windows release variants spanning over a decade of releases - creates significant patch-deployment complexity for organizations with heterogeneous estates. Internet-exposed RDP endpoints face substantially elevated risk versus RDP deployments restricted behind VPN.

An attacker holding a low-privilege domain or local account on a network-reachable Windows host with RDP enabled crafts a sequence of RDP protocol messages designed to trigger a race condition in the Remote Desktop Services memory allocator, causing a use-after-free in the RDS heap. The attacker then sprays controlled data into the freed memory region and redirects RDS execution to attacker-supplied shellcode, achieving code execution with the privileges of the RDS service. No public proof-of-concept code has been identified; the AC:H rating implies non-trivial exploitation skill is required.