Remote Desktop Gateway EUVD-2026-99139

Exploitation requires the target host to have the Remote Desktop Gateway (RD Gateway) role service installed, running, and reachable over the network - this is not present on default Windows Server installs, so only servers deliberately configured as RD Gateways are affected. Where that role is deployed (frequently internet-facing on TCP 443 to broker remote desktop sessions), the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no credentials, and no user interaction are needed to trigger the memory leak. Limiting factors: the attack affects availability only (no data exposure or code execution), impact is cumulative/resource-exhaustion rather than instantaneous, and exposure is bounded to hosts running the RD Gateway role within the enumerated unpatched Windows Server build ranges.

Signals converge on a moderate, availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a remote, low-complexity, unauthenticated denial of service with no confidentiality or integrity impact - consistent with the CWE-401 memory leak described. CISA's SSVC framework aligns and tempers this: Exploitation=none (no observed or public exploitation), Automatable=yes (the unauthenticated network trigger can be scripted at scale), and Technical Impact=partial (service disruption, not full system control). The vulnerability is NOT in CISA KEV and no POC is referenced, so this is no public exploit identified at time of analysis. No EPSS score was provided, so exploitation probability cannot be quantified from the input. Net: this is a genuine patch-worthy issue for internet-exposed RD Gateway servers because the memory leak can be driven remotely without credentials and is automatable, but it is not an emergency - there is no evidence of active exploitation and the impact is limited to availability (service exhaustion/crash), not data theft or code execution. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts both the description (a memory-leak DoS) and the CVSS impact triad (C:N/I:N/A:H); treat the tag as erroneous, not as evidence of an auth-bypass capability.

An attacker locates an internet-facing Remote Desktop Gateway (commonly exposed on TCP 443 for remote access) and repeatedly sends connection requests that each cause the service to allocate memory that is never released. Over time the leaked memory exhausts available resources, degrading or crashing the RD Gateway Service and cutting off legitimate remote-access users. The CVSS AV:N/AC:L/PR:N/UI:N vector confirms this needs only network reach with no authentication, credentials, or user interaction; no public exploit code is currently identified.