CVE-2026-70187
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A use after free vulnerability in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Risk Assessment
An unauthenticated attacker could remotely execute code on the RD Gateway server, potentially leading to takeover of the remote access infrastructure.
Recommendation
Immediately install security updates for Remote Desktop Gateway and consider restricting internet access to the service.
Other vulnerabilities in Remote Desktop Gateway Service
See all- CVE-2026-84012High
Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-84007Medium
An out-of-bounds read in the Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network.
- CVE-2026-70033High
A missing release of memory after effective lifetime vulnerability exists in the Remote Desktop Gateway Service. An unauthorized attacker can exploit this flaw to deny service over a network.
- CVE-2026-100218High
A use after free vulnerability in the Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-69338High
Use-after-free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69292High
Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS