Remote Desktop Gateway CVE-2026-84007

The Remote Desktop Gateway role must be installed and reachable on an affected Windows Server build (2012, 2012 R2, 2016, 2019, 2022, or 2025, including Server Core, below the listed patched versions). Per the CVSS vector (PR:L) and the description's 'authorized attacker' wording, the attacker must hold some level of valid authorization/credentials to interact with the service - this is NOT an unauthenticated flaw, which meaningfully limits exposure. Exploitation requires no user interaction (UI:N) and low complexity (AC:L), but the payoff is confidentiality-only (information disclosure); there is no integrity or availability impact, and SSVC rates it non-automatable with only partial technical impact. Internet-facing RD Gateways with weak credential hygiene are the realistic risk surface; internal-only gateways behind strong authentication are substantially lower risk.

This is a moderate-priority information-disclosure flaw, not a critical emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack that nonetheless requires some level of authorization (PR:L) and yields high confidentiality impact with no integrity or availability effect - consistent with reading out-of-bounds memory (CWE-125) from the Remote Desktop Gateway Service. The signals are internally consistent and point AWAY from urgent, widespread risk: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which aligns with an info-leak that requires an authenticated session and is not trivially wormable. No EPSS score was supplied in the input, and there is no CISA KEV listing and no public exploit code referenced, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals here - the CVSS auth requirement, the SSVC 'none/no/partial' ratings, and the absence of KEV/POC all converge on a real-but-contained issue that merits patching in the normal Microsoft update cycle rather than out-of-band action. The main caveat is that an authenticated attacker on a network-exposed RD Gateway could leak sensitive memory contents, so internet-facing gateways should be prioritized over internal ones.

An attacker who already holds valid (even low-privileged) credentials to reach the Remote Desktop Gateway Service sends a specially crafted request that causes the service to read beyond an allocated buffer boundary. The out-of-bounds read returns adjacent process memory to the attacker over the network, potentially disclosing sensitive data such as session tokens, configuration, or other users' data. No public exploit code is identified at time of analysis, and the attack produces information disclosure only - no code execution or service disruption.