Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Remote Desktop Client allows unauthorized code execution over network

CVE-2026-47654 · published 4 months ago
Summary

The Remote Desktop Client software has a flaw that could allow an attacker to take control of a computer over a network connection. This is a serious security risk because it could let an attacker do anything on the computer, including stealing sensitive information. To protect yourself, make sure your Remote Desktop Client is up to date with the latest security patches.

What to do
  • Update microsoft windows_server_2016 to version 10.0.14393.9234 or later.
  • Update microsoft windows_server_2019 to version 10.0.17763.8880 or later.
  • Update microsoft windows_server_2022 to version 10.0.20348.5256 or later.
  • Update microsoft windows_server_2025 to version 10.0.26100.32995 or later.
  • Update microsoft windows server 2016 to version 10.0.14393.9234 or later.
  • Update microsoft windows server 2016 (server core installation) to version 10.0.14393.9234 or later.
  • Update microsoft windows server 2019 to version 10.0.17763.8880 or later.
  • Update microsoft windows server 2019 (server core installation) to version 10.0.17763.8880 or later.
  • Update microsoft windows server 2022 to version 10.0.20348.5256 or later.
  • Update microsoft windows server 2025 to version 10.0.26100.32995 or later.
  • Update microsoft windows server 2025 (server core installation) to version 10.0.26100.32995 or later.
Affected software
VendorProductAffected versions
microsoft windows_server_2016 < 10.0.14393.9234
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft windows_server_2019 < 10.0.17763.8880
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft windows_server_2022 < 10.0.20348.5256
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft windows_server_2025 < 10.0.26100.32995
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
microsoft windows server 2016 < 10.0.14393.9234
microsoft windows server 2016 (server core installation) < 10.0.14393.9234
microsoft windows server 2019 < 10.0.17763.8880
microsoft windows server 2019 (server core installation) < 10.0.17763.8880
microsoft windows server 2022 < 10.0.20348.5256
microsoft windows server 2025 < 10.0.26100.32995
microsoft windows server 2025 (server core installation) < 10.0.26100.32995
Original advisory text
Remote Desktop Client Remote Code Execution Vulnerability
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
CWE-787Out-of-bounds Write
Timeline
Published9 Jun 2026
Updated4 Nov 2026
First seen12 Jun 2026
Sources
CVE-2026-47654 · NVD
CVE-2026-47654 · MITRE
Track software like this
Free during beta