Microsoft Ships Fixes for High-Severity RDP Gateway Use-After-Free Flaw

Microsoft has released security updates to address a remote code execution vulnerability in the Remote Desktop Gateway service. The flaw allows unauthorized attackers to execute code on affected systems over a network.

What happened

Microsoft identified a use-after-free memory corruption issue within the Remote Desktop Gateway Service. According to the official security advisory, this vulnerability enables an unauthorized attacker to execute arbitrary code over a network connection. The National Vulnerability Database recorded the flaw as CVE-2026-100218 and assigned it a CVSS score of 8.1. This score places the vulnerability in the high severity category. The weakness is classified under CWE-416, which covers use-after-free errors.

The issue impacts specific builds of Microsoft Windows operating systems. Affected versions include Windows 10 Version 1607 before build 10.0.14393.9612, Windows 10 Version 1809 before build 10.0.17763.9376, and Windows 10 Version 21H2 before build 10.0.19044.7807. Windows 10 Version 22H2 is also affected if it remains on builds earlier than 10.0.19044.7807. Microsoft Windows 11 version 23H2 is vulnerable if the system runs a build earlier than 10.0.22631.7652.

Why it matters

Remote Desktop Gateway services often sit at the edge of corporate networks, making them attractive targets for attackers seeking internal access. A high-severity remote code execution flaw in such a service can allow adversaries to bypass authentication controls. As Patch Gazette reported on 2026-10-14 regarding a similar Windows Error Reporting heap overflow, unauthenticated remote code execution risks are consistently rated as critical or high by security databases. Organizations relying on these older Windows builds for remote access infrastructure face significant exposure until they apply the latest cumulative updates.

What to watch

• Monitor Microsoft Security Update Guide for any new advisories related to Remote Desktop services.
• Check internal logs for unusual authentication failures or network connections to RD Gateway servers.
• Verify that all Windows 10 and 11 builds have reached the specified patched versions.
• Review firewall rules to ensure RD Gateway ports are not unnecessarily exposed to the internet.

Who needs to act first

IT managers should prioritize systems that expose Remote Desktop Gateway services to untrusted networks. Teams usually begin by identifying which servers host these services and confirming their current OS builds. Before rolling out updates, administrators should test the patches in a non-production environment to ensure compatibility with existing configurations. If immediate patching is not possible, organizations should consider restricting network access to these services using strict firewall rules. Backing up critical system states before applying updates remains a standard practice to facilitate recovery if issues arise.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Audit your inventory to identify all servers running affected versions of Windows 10 or 11.
• Apply the latest cumulative security updates provided by Microsoft to reach the patched build numbers.
• Restrict access to Remote Desktop Gateway services to trusted IP addresses or internal networks only.
• Enable detailed logging on RD Gateway servers to detect and investigate suspicious connection attempts.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Windows versions are affected by CVE-2026-100218?

Windows 10 versions 1607, 1809, 21H2, and 22H2 below specific builds, and Windows 11 version 23H2 before build 10.0.22631.7652 are affected.

What is the severity rating for this vulnerability?

The National Vulnerability Database rates CVE-2026-100218 as high severity with a CVSS score of 8.1.

Is there a fix available for this remote code execution flaw?

Yes, Microsoft has released updates that patch the vulnerability for all affected Windows versions listed in the advisory.