Patch Windows Server Now: October 2026’s Critical RDP CVEs

If you run a Windows VPS or a Windows Server with Remote Desktop exposed, this one’s for you: October 13, 2026’s Patch Tuesday shipped fixes for some genuinely nasty RDP flaws — including an unauthenticated remote code execution bug in Remote Desktop Gateway that scores 8.1 on the CVSS scale. If you haven’t patched yet, now is the time to patch Windows Server before someone else finds your box first.

This isn’t the usual “update and reboot” lecture. Three separate CVEs landed in the same cycle, all touching Remote Desktop, and one of them lets an attacker who has never logged in run code on your gateway server. Below: what each flaw does, which versions are affected, the exact KB numbers to install, and how to verify you’re covered.

What happened on October 13, 2026

Microsoft’s October 2026 Patch Tuesday was a busy one for anyone running Remote Desktop. Alongside the usual cumulative updates, the security release included advisories for three distinct vulnerabilities in the Remote Desktop stack — the gateway service that sits on your network edge, and the RDP client itself.

Here’s the short version:

CVE	Component	Impact	CVSS	Auth needed?
CVE-2026-70187	Remote Desktop Gateway	Remote code execution	8.1 (High)	No
CVE-2026-84007	Remote Desktop Gateway	Information disclosure	Medium-High	Yes (low privilege)
CVE-2026-69976	RDP client (mstsc)	Remote code execution	7.5 (High)	No (victim connects)

The pattern is hard to miss: October was Remote Desktop’s bad month. And if your server is reachable from the internet — which, for a Windows VPS, it usually is — the gateway flaw deserves your attention first.

CVE-2026-70187: unauthenticated RCE in RD Gateway

This is the headline act. CVE-2026-70187 is a use-after-free (CWE-416) vulnerability in the Windows Remote Desktop Gateway service — the component that proxies RDP traffic from the internet to your internal session hosts over HTTPS (port 443) and UDP (port 3391).

The flaw lives in the connection negotiation and tunneling routines of the RDS server role. An attacker sends a crafted handshake to the gateway, and — because the gateway is designed to inspect incoming client requests before passing them to the session broker — the exploit lands before authentication ever happens. Successful exploitation executes arbitrary code in the security context of NT AUTHORITY\NETWORK SERVICE.

What makes this one particularly uncomfortable:

• Unauthenticated. No valid credentials, no session, nothing. Just a network path to the gateway.
• NLA doesn’t save you. Network Level Authentication protects the RDP endpoint behind the gateway — but the vulnerable code runs in the gateway daemon itself, before NLA is ever reached.
• Perimeter position. RD Gateway servers are deliberately deployed on network edges to bridge external traffic inward. A foothold there is a foothold into the internal network — and potentially Active Directory.

Affected platforms: Windows Server 2022, Windows Server 2025, and Windows 11 Enterprise multi-session. If you run the RD Gateway role on either server version and it’s reachable from the internet, treat this as patch-today urgent.

CVE-2026-84007: RD Gateway info disclosure

Published to the National Vulnerability Database on the same day (October 13, 2026), CVE-2026-84007 is an out-of-bounds read (CWE-125) in the same RD Gateway service. This one needs a low-privilege authenticated session — a lower bar than it sounds, since RD Gateway exists precisely to give remote users sessions.

When the service processes attacker-influenced input, it reads past the intended buffer boundary and hands the leaked bytes back to the attacker’s session. Because RD Gateway handles authentication material, tunneling metadata, and session state, the disclosed memory can contain genuinely sensitive data: session tokens, credentials, or internal gateway state transiting the service.

It doesn’t give code execution and it doesn’t take the service down — but it quietly undermines the confidentiality of everything flowing through the gateway. On a shared or multi-tenant gateway, that’s a serious problem.

CVE-2026-69976: RDP client remote code execution

The third flaw flips the direction: instead of attacking the server, it attacks the person connecting. CVE-2026-69976 is a remote code execution vulnerability in the Microsoft RDP client, published October 14, 2026, with a severity rating of High (7.5).

Affected products include Windows Server 2019, 2022, and 2025 (plus 2016 and 2012 R2) — essentially any box where someone uses the built-in Remote Desktop client to connect out to another machine. Connect to a malicious or compromised RDP server, and the server can execute code on your client.

The practical takeaway for server admins: yes, patch the servers — but also make sure the machines you administer from (your workstation, your jump box) are patched too. The admin’s laptop is part of the attack surface here.

Which KB patch fixes your server

The October 2026 Patch Tuesday shipped a separate cumulative update per platform. Find your version, install the matching KB, and you pick up the fixes for all three CVEs above:

Platform	October 2026 KB	How to get it
Windows Server 2025	KB5126646	Windows Update / WSUS / Update Catalog
Windows Server 2022	KB5126655	Windows Update / WSUS / Update Catalog
Windows Server 2019	KB5126651	Windows Update / WSUS / Update Catalog
Windows Server 2016	KB5126868	Windows Update / WSUS / Update Catalog
Windows 11 (client/admin PCs)	KB5127648	Windows Update

For the authoritative per-CVE mapping — which exact builds each advisory covers — check Microsoft’s own Security Update Guide entry for CVE-2026-70187 and the linked advisories for the other two. KB numbers can get superseded by later cumulative updates, so if you’ve installed anything newer than October 13, you’re already covered.

How to patch Windows Server right now

Patching is a ten-minute job on most VPS boxes. Here’s the order I’d do it in:

1. Check what you’re running and what’s installed. Open an elevated PowerShell and look at your OS build and installed hotfixes:

(Get-ComputerInfo).WindowsProductName
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn

If you see KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126651 (Server 2019), or KB5126868 (Server 2016) in the list, the October fixes are already installed — move on to verification.

2. Install the update. The simplest route on a VPS is Settings → Windows Update → Check for updates, or this one-liner in elevated PowerShell:

Install-Module PSWindowsUpdate -Force
Install-WindowsUpdate -AcceptAll -AutoReboot

Yes, it needs a reboot. Schedule it — don’t let it surprise you at 3 AM. If you’re on a provider console (most VPS hosts give you one), rebooting remotely is painless.

3. Verify the patch landed. After the reboot, re-run the Get-HotFix check above and confirm the KB for your platform is present. Then confirm the RD Gateway service is running the patched build:

Get-Service TermService, TSGateway -ErrorAction SilentlyContinue | Format-Table Name, Status

4. Patch your admin machines too. Remember CVE-2026-69976 targets the RDP client. The workstation or jump box you connect from needs KB5127648 (Windows 11) just as much as the server does.

Can’t patch yet? Temporary mitigations

Sometimes you can’t reboot a production box today. These mitigations don’t replace the patch, but they shrink the window while you schedule it:

First: check whether your gateway is even exposed

Not every Windows Server runs the RD Gateway role — and if yours doesn’t, CVE-2026-70187 and CVE-2026-84007 can’t touch you. Check in one command:

Get-WindowsFeature RDS-Gateway | Select-Object Name, InstallState

If InstallState says Available (not Installed), the role isn’t on this box — you’re only exposed to the client-side CVE-2026-69976, which still warrants patching, but the urgency drops a notch. If it says Installed, check whether it’s reachable from the internet: from an outside machine, try connecting to https://your-server-ip:443 or run a quick port check against 443 and UDP 3391. If either answers, you’re in the high-priority group.

A lot of Windows VPS owners are surprised to learn their provider’s default image has more roles enabled than they assumed. Five minutes of checking beats guessing.

• Don’t expose RD Gateway to the whole internet. If the gateway doesn’t need to be reachable from everywhere, restrict it — firewall rules, IP allowlists, or a VPN in front of it. CVE-2026-70187 needs a network path to the gateway; remove the path and you remove the exploit.
• Enforce Network Level Authentication on all RDP endpoints and limit RDP logon rights to trusted administrative accounts via Group Policy. This doesn’t fix the gateway daemon itself, but it hardens everything behind it.
• Disable Remote Desktop Services on hosts that don’t need it. No service, no attack surface. Sounds obvious; it’s still the most underused mitigation in the book.
• Watch for exploitation attempts. Unexpected crashes or Windows Error Reporting entries referencing termsrv.dll or rdpcorets.dll, or new high-privilege child processes spawning after standard-user RDP logons, are worth investigating immediately.
• Keep Network Level Authentication on and remove standard users from the Remote Desktop Users group wherever they don’t belong.

If you’re hardening a fresh box anyway, our VPS security checklist walks through the rest of the lockdown — firewall rules, brute-force protection, and the settings most people skip.

Also this month: the 0xC000000D RDP breakage

Confusingly, the same Patch Tuesday that fixes these CVEs also introduced a headache: installing KB5127648 on Windows 11 (24H2–26H2) with Administrator Protection enabled breaks RDP for non-admin users with error 0xC000000D (“The token that was passed to the function is invalid”). Microsoft has confirmed it, and it’s a separate issue from the CVEs above.

So yes — patch, but know what you’re walking into: if your admin workstation hits 0xC000000D after updating, that’s the known breakage, not the vulnerability. We covered the full cause and workarounds in How to Fix RDP Error 0xC000000D After the October 2026 Windows Update.

And if you’re still on the fence about whether RDP is safe to expose at all, Is RDP Safe? breaks down the real risks and what actually mitigates them.

FAQ

Do I need to patch if I don’t use Remote Desktop Gateway?

Yes — partially. CVE-2026-70187 and CVE-2026-84007 only affect the RD Gateway role, so a server without it isn’t exposed to those two. But CVE-2026-69976 hits the RDP client on Server 2019/2022/2025 regardless, and cumulative updates bundle all three fixes anyway. Patch.

Is CVE-2026-70187 being exploited in the wild?

Microsoft’s advisory is the authoritative source for exploitation status, and it can change. What we know: it’s unauthenticated, network-reachable, and sits on perimeter servers — the exact profile attackers scan for within days of disclosure. Don’t wait for a headline; patch on that basis alone.

Does Network Level Authentication protect against CVE-2026-70187?

No. NLA authenticates the user before the RDP session starts, but this vulnerability is in the gateway daemon’s handshake handling — it triggers before NLA is ever reached. Only the patch (or removing network access to the gateway) closes it.

Will the October update break my RDP like KB5127648 did?

The 0xC000000D breakage affects Windows 11 clients (24H2–26H2) with Administrator Protection on — not Windows Server. Server-side, the October cumulative updates install cleanly in the vast majority of cases. Still, snapshot or back up before patching any production box; that’s just good hygiene.

I’m on a cheap Windows VPS — does my host patch for me?

Almost certainly not. On unmanaged and most “managed” Windows VPS plans, OS patching is your job. Log in, check Get-HotFix, and install the update yourself — it takes ten minutes.

The bottom line

October 2026 was Remote Desktop’s worst month in a while: an unauthenticated RCE in the gateway, an info-disclosure bug in the same service, and an RCE in the client — all disclosed within 48 hours. The fixes are out, they’re bundled into the regular cumulative updates, and installing them is a ten-minute job.

So patch Windows Server today: install your platform’s October KB, reboot, verify with Get-HotFix, and don’t forget the machines you administer from. The attackers scanning for CVE-2026-70187 aren’t waiting — neither should you.