CVE-2026-69525 is a use-after-free bug in Windows Remote Desktop Services (RDS): Microsoft’s platform for delivering centrally hosted Windows desktops and applications to people over Remote Desktop Protocol. A network attacker can trigger the flaw without credentials or user interaction, then execute code on the target system. Microsoft rates it Critical with a 9.8 CVSS 3.1 score and calls exploitation “More Likely” in its published record.
RDS is not a niche optional app. Organisations use its session-host, virtual-desktop, gateway and RemoteApp capabilities to give employees, contractors and partners remote access to line-of-business software while keeping data in the datacentre. That puts enterprises, government, healthcare and financial organisations, call centres, schools, managed desktop providers and hosting operators in the likely exposure set.
A lifetime bug on a network-facing service
A use-after-free occurs when software continues to use an object after its memory has been released. In this case, a remote party can apparently drive that bad state through RDS and turn it into code execution. Microsoft does not disclose the affected object, function, protocol message or the specific lifetime-management mistake, so defenders should not assume that filtering a guessed packet pattern is a durable mitigation.
The access prerequisite is the important operational detail: an attacker needs network reachability to a vulnerable RDS service, not a Windows account. Internet-exposed RDP and gateway paths deserve the first review, but internal session hosts are also relevant wherever an attacker could reach them after compromising another machine. A claim that the vulnerable route requires Network Level Authentication has circulated, but no independently reviewable patch analysis or binary diff was available to confirm it.
As of September 14, there was no confirmed exploitation in the wild, no named campaign or malware connection, and no public proof of concept or exploit code could be confirmed. It is also absent from CISA’s Known Exploited Vulnerabilities catalogue. Those are useful current signals, not a reason to postpone action: Microsoft’s exploitability assessment and the unauthenticated network path make exposed services a natural target for future research.
Patch every applicable Windows branch
Microsoft shipped fixes in the September 8, 2026 Windows security updates. There is no single fixed version because RDS is an operating-system component. Teams should deploy the applicable cumulative update, reboot where required, and verify the resulting build against the affected branch’s threshold. For example, the first fixed builds are 10.0.14393.9512 for Windows 10 1607 and Windows Server 2016, 10.0.17763.9245 for Windows 10 1809 and Server 2019, 10.0.20348.5622 for Server 2022, and 10.0.26100.33438 for Server 2025. The full branch-to-build and KB mapping is available in the update listing.
Include Server Core in the inventory: it is separately affected on several server releases and can be easy to overlook when teams focus on interactive RDS hosts. Before broad rollout, test the cumulative update against connection brokers, gateways, session hosts and published applications. Some organisations reported RDS connection failures or hangs after September cumulative updates, but Microsoft has not said the CVE-2026-69525 fix itself caused that regression.
Until patching is complete, remove direct Internet exposure where feasible, restrict RDP and RDS access to VPNs or tightly controlled allowlists, segment session hosts, and monitor for unexpected RDS-facing connections. In practice, this is an inventory-and-exposure problem as much as a patch problem; SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs.
