CVE-2026-58626

What it actually does

CVE-2026-58626 is a use-after-free vulnerability in Windows Remote Desktop Services. An authenticated network attacker can trigger unsafe memory reuse in the RDS service and potentially gain arbitrary code execution on the target Windows system. Because exploitation is network-accessible, low-complexity, requires no user interaction, and can affect confidentiality, integrity, and availability, successful exploitation could allow an attacker to run code in the security context of the vulnerable RDS component, crash the service, or use the compromised host as a foothold for lateral movement.

Why it matters to the business

Organizations exposing Remote Desktop Services on workstations or servers face risk of remote system compromise by attackers who already have valid credentials or can obtain them through phishing, credential theft, password spraying, or brokered access. Compromise of RDS hosts can disrupt remote administration and user access, enable data theft, ransomware staging, and lateral movement, and may be especially impactful on Windows Server systems that provide shared remote access. The issue is not currently listed in CISA KEV and no public exploit maturity is reported, but the high CVSS score and broad Windows coverage make timely patching important.

How an attack unfolds

An attacker first obtains valid credentials for an account permitted to reach or authenticate to Remote Desktop Services. They identify a vulnerable Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 host with RDP/RDS reachable over the network, typically on TCP/3389 or through an RDS Gateway. The attacker initiates authenticated RDS protocol activity crafted to trigger the use-after-free condition in the Remote Desktop Services component. If the memory corruption is reliably controlled, the attacker executes code on the target host, potentially installs tooling, creates persistence, dumps credentials, disables defenses, or pivots to other systems. Failed exploitation attempts may appear as RDS service crashes, application faults, or abnormal disconnects around authenticated RDP sessions.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-58626 for all affected Windows versions, including Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025. Because no explicit fixed build numbers were provided, use the latest applicable cumulative update from Microsoft for each supported platform and verify that the July 2026 or later security fixes are installed. Where immediate patching is not possible, restrict RDP/RDS exposure to trusted management networks or VPNs, block direct internet access to TCP/3389, require Network Level Authentication, enforce MFA for remote access, remove unnecessary RDS permissions, and monitor for abnormal RDS crashes or authentication patterns. Disabling Remote Desktop Services on systems that do not require it is an effective mitigation.

How to confirm the fix worked

Confirm that each affected Windows endpoint and server has installed the Microsoft cumulative update containing the fix by checking Windows Update history, enterprise patch management inventory, or PowerShell commands such as Get-HotFix and querying installed build/UBR values. Validate that Remote Desktop exposure is limited by scanning for TCP/3389 and reviewing firewall, VPN, and RDS Gateway policies. Confirm that Network Level Authentication is enabled where RDP remains required. For representative systems, verify that Remote Desktop Services remains stable after patching and that no unexpected application fault events for TermService, termsrv.dll, or svchost.exe are observed. Vulnerability scanners should be updated with the relevant Microsoft detection logic and rerun after remediation.

Typical attack path

1. Acquire valid credentials for an account allowed to authenticate to Remote Desktop Services.
2. Scan or enumerate reachable Windows systems exposing RDP/RDS, commonly TCP/3389 or access through an RDS Gateway.
3. Authenticate to the vulnerable RDS service from a remote system.
4. Send crafted RDS protocol traffic that triggers the use-after-free condition.
5. Achieve code execution or crash the RDS service if exploitation is unstable.
6. Run post-exploitation commands, deploy malware or remote tooling, harvest credentials, and move laterally.

How to detect it

To determine whether exploitation may have already occurred, review Windows Security logs for successful RDP logons, especially Event ID 4624 with Logon Type 10, followed closely by unusual process creation, privilege escalation, credential access, or outbound connections. Correlate TerminalServices-LocalSessionManager and TerminalServices-RemoteConnectionManager logs for unexpected session creation, reconnects, disconnects, and authentication from unfamiliar source IPs. Check Application and System logs for crashes or restarts of Remote Desktop Services, svchost.exe hosting TermService, or faults involving termsrv.dll with access violation codes such as 0xc0000005. Review EDR telemetry for suspicious child processes or activity after RDP logon, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, schtasks.exe, net.exe, nltest.exe, whoami.exe, quser.exe, and credential dumping tools. Network teams should examine inbound RDP traffic patterns to TCP/3389 or RDS Gateway logs for authenticated sessions from unusual geographies, anonymization services, new devices, or high-volume connection attempts. Because no public exploit-specific indicators are available, detection should focus on authenticated RDP access anomalies, service instability, and post-exploitation behavior on RDS-accessible hosts.

• TCP/3389
• LogonType=10
• Logon Type: 10
• Event ID 4624
• Event ID 4778
• Event ID 4779
• Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
• Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
• TermService
• Remote Desktop Services
• termsrv.dll
• svchost.exe
• 0xc0000005
• Application Error
• Faulting module name: termsrv.dll
• Faulting application name: svchost.exe
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• mshta.exe
• certutil.exe
• bitsadmin.exe
• schtasks.exe
• quser.exe
• qwinsta.exe

What your security team should do

• Prioritize patching internet-exposed RDP/RDS hosts, RDS Gateways, jump servers, domain-joined servers, and high-value administrative workstations.
• Inventory all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems with Remote Desktop enabled or TCP/3389 reachable.
• Restrict RDP access to VPN, privileged access workstations, bastion hosts, or approved management subnets; block direct internet exposure wherever possible.
• Enforce MFA, strong password policy, account lockout, and least-privilege membership for groups allowed to log on through Remote Desktop Services.
• Enable or confirm Network Level Authentication for Remote Desktop connections.
• Hunt for RDS service crashes, abnormal authenticated RDP sessions, suspicious post-login process execution, and lateral movement from RDS-accessible systems.
• Increase logging coverage for Security events, TerminalServices logs, PowerShell, process creation, and EDR telemetry on systems providing RDP access.
• Treat suspicious RDP authentication followed by service crashes or unusual command execution as a potential exploitation attempt and isolate the host for forensic review.