CVE-2026-47654(microsoft / windows_server_2016)

LOWCVSS 7.5 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-416CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_server_2016
  • windows_server_2019
  • windows_server_2022
  • windows_server_2025

Affected systems

Vendors
Products
windows_server_2016windows_server_2019windows_server_2022windows_server_2025

Deep dive

Full discourse1 post
  • TheSAS2026@TheSAScon

    Pre-auth vulnerability in Windows Remote Desktop Gateway? Victor V (@vv474172261) was adept at finding those back in 2024. Now, he came back to this attack surface armed by AI. At #TheSAS2026, Victor promised to tell how he found a recent CVE-2026-47654 using "AI mining." He's now sharing a recap on RDG architecture before making the talk really spicy.

    02050453
    4.3K followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2025--x64

Explore more