Remote Desktop Gateway EUVD-2026-99608

Exploitation requires the target Windows Server host to have the Remote Desktop Gateway role/service installed and running and network-reachable by the attacker - RD Gateway is not enabled by default, so only servers explicitly deployed to proxy RDP connections (commonly internet-facing) are affected. No authentication (PR:N) and no user interaction (UI:N) are needed once the service is reachable. The principal LIMITING factor is the High attack complexity (AC:H): the use-after-free almost certainly depends on winning a race condition or achieving a specific memory/heap state, consistent with CISA's Automatable: 'no', meaning reliable exploitation is non-trivial and not amenable to simple automated mass exploitation. Affected and requiring patch: Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations) below the fixed build numbers listed in the EUVD data.

This is a genuinely serious vulnerability that warrants prioritization, though not at the absolute top tier of 'patch immediately' emergencies based on current signals. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with no user interaction required, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - the 8.1 score is held below 9+ solely by the High attack complexity (AC:H), which for a CWE-416 use-after-free typically reflects a race-condition or heap-grooming requirement rather than a trivially deterministic trigger. Signals are consistent rather than conflicting: CISA's SSVC framework lists Exploitation as 'none' (no observed exploitation), Automatable as 'no' (aligning with AC:H - not a point-and-click mass-exploitable bug), and Technical Impact as 'total' (aligning with the C:H/I:H/A:H RCE outcome). The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no evidence of active exploitation. MISSING DATA to note explicitly: no EPSS exploitation-probability score was provided, so the quantitative near-term exploitation likelihood cannot be stated; and no POC availability signal was provided. Net assessment: a pre-auth RCE in an internet-facing gateway role is inherently high-value to attackers, but the AC:H/Automatable:no profile means weaponization is non-trivial and, if exploitation emerges, is more likely to be targeted than commodity/wormable. Prioritize patching of internet-exposed RD Gateway hosts while recognizing exploitation is unproven today.

A remote, unauthenticated attacker reaches an internet-facing Windows Server running the Remote Desktop Gateway role and sends a crafted sequence of gateway protocol requests that triggers a use-after-free in the service, winning a timing/heap race (reflecting the High attack complexity) to reclaim the freed object and achieve arbitrary code execution in the gateway process context. No public exploit is identified at time of analysis, and CISA SSVC lists exploitation as 'none', so this remains a plausible but currently unproven scenario rather than observed in-the-wild activity.