[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTvaiR3tTlP3B7qcEPWOWqfywKUjresXHtpW4u9OKV6o":3},{"article":4,"iocs":36,"watch_terms":50,"solutions":51,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"17905cc8-1eec-45dc-b871-1394f1395924","Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network","multiple-windows-remote-desktop-flaws-allow-attackers-to-execute-code-over-netwo-aa67c9","Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities that could allow attackers to run code through network connections or local access. Published on November 10, 2026, the flaws involve memory handling errors and a race condition. Three have network attack paths, while the fourth requires an attacker with existing local access, […] The post Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network appeared first on Cyber Security News.","Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities. Three of these flaws have network attack paths, while the fourth requires existing local access. The highest-scoring flaw, CVE-2026-119934, is a double-free bug with a CVSS score of 8.8. Other vulnerabilities include heap-based buffer overflows and a race condition, with varying requirements for exploitation such as user interaction or specific configurations.","Microsoft releases updates for four Windows Remote Desktop Client flaws allowing code execution.","https:\u002F\u002Fcybersecuritynews.com\u002Fmultiple-windows-remote-desktop-vulnerabilities\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FMultiple-Windows-Remote-Desktop-Vulnerabilities-Allow-Attackers-to-execute-code-Over-Network.webp","2026-11-11T11:22:00+00:00","2026-11-11T12:00:40.302819+00:00",8,[17,20],{"name":18,"type":19},"Windows Remote Desktop Client","product",{"name":21,"type":22},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[37,41,44,47],{"type":38,"value":39,"context":40},"cve","CVE-2026-119934","Double-free bug in Windows Remote Desktop Client",{"type":38,"value":42,"context":43},"CVE-2026-119858","Heap-based buffer overflow in Windows Remote Desktop Client",{"type":38,"value":45,"context":46},"CVE-2026-95964","Race condition in Windows Remote Desktop Client",{"type":38,"value":48,"context":49},"CVE-2026-119390","Local heap-based buffer overflow in Windows Remote Desktop Client",[21,18],{"controls":52,"vendors":139},[53,81,110],{"slug":54,"name":55,"problem":56,"products":57},"patch-management","Automated patch management","Known holes get closed in days, not months.",[58,65,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":54,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":82,"name":83,"problem":84,"products":85},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":111,"name":112,"problem":113,"products":114},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":155},"critical-windows-rdp-flaws-enable-remote-code-execution-patch-immediately","Critical Windows RDP Flaws Enable Remote Code Execution — Patch Immediately","Microsoft disclosed four Remote Desktop Client vulnerabilities, three of which can be exploited entirely over the network without requiring local access, making them particularly dangerous for any internet-exposed or internally accessible Windows environment. The most severe flaw (CVE-2026-119934, CVSS 8.8) is a double-free memory corruption bug, alongside heap-based buffer overflows and a race condition — all classes of vulnerability that arise from unsafe memory management in widely deployed software. Because RDP is one of the most commonly exposed services in enterprise environments, unpatched systems present a high-value target for ransomware operators and state-sponsored attackers alike. Delayed patching of network-reachable code execution flaws dramatically increases the window of exposure and the likelihood of successful compromise.",[150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","MITRE ATT&CK T1210: Exploitation of Remote Services",{"NIS2 Article 21(2)(e)":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"MITRE ATT&CK T1210: Exploitation of Remote Services":158,"CIS Control 7: Continuous Vulnerability Management (v8)":159,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":160},"NIS2 Article 21(2)(e) covers vulnerability handling and disclosure in the acquisition and maintenance of systems, requiring entities to have processes for addressing exactly these kinds of vendor-disclosed remote code execution flaws.","SI-2 requires identifying, reporting, and correcting information system flaws within defined timeframes — directly applicable to the need to patch these network-exploitable RDP vulnerabilities rapidly.","T1210 describes adversaries exploiting vulnerabilities in network-accessible remote services such as RDP to gain initial access or move laterally, which is the precise attack vector enabled by these flaws.","CIS Control 7 requires organisations to continuously assess and remediate vulnerabilities; applying Microsoft's RDP patches promptly is exactly the remediation cadence this control mandates.","This category requires that once vulnerabilities like these RDP flaws are disclosed, organisations either mitigate them or formally accept the risk — driving the patch-or-compensate decision."]