Microsoft Discloses CVE-2026-84012 Remote Code Execution Flaw in Remote Desktop Services

Microsoft has disclosed CVE-2026-84012, a vulnerability in the Windows Remote Desktop Services component that allows unauthorized attackers to execute code over a network. The flaw stems from a double-free error within the Remote Desktop Gateway Service, as detailed in the Microsoft Security Update Guide. This disclosure arrives while administrators are still managing stability issues from recent patch cycles.

The security update guide identifies the specific mechanism of the vulnerability without providing a CVSS score in the initial advisory. Attackers can exploit this double-free condition to gain remote code execution capabilities. This adds to the complexity of managing Remote Desktop infrastructure, which has faced significant operational challenges in recent weeks due to conflicting update requirements and residual bugs.

Context of Recent Updates and Disruptions

Microsoft released an out-of-band update on September 14, 2026, to address severe problems introduced by its September 8 security updates, according to Cyber Security News. Those September patches caused Remote Desktop Services to fail, resulting in lost connections, rejected sign-ins, and systems stuck during configuration. The disruption also affected the Microsoft Management Console, RDS Licensing Diagnoser, and File Explorer.

The September 14 release aimed to restore functionality for Remote Desktop Services, Linux virtual machine shared folders, and USB audio devices. However, Microsoft warned that the update does not resolve every reported USB audio problem, specifically leaving Code 10 errors and unresponsive volume controls unfixed. Administrators must verify whether their specific hardware issues are covered by this hotpatch or require further attention.

Affected Systems and Workarounds

A separate issue affecting Windows 11 versions 24H2, 25H2, 26H1, and 26H2 prevents non-admin users from connecting to remote hosts with Administrator protection enabled. This problem emerged after the September 22, 2026, non-security preview update KB5124010. Failed connections return error 0xC000000D and display an invalid token message. Microsoft marked the issue as mitigated on October 13.

IT administrators can temporarily disable Administrator protection on affected hosts using Microsoft Intune or Group Policy to restore connectivity. This workaround involves resetting the User Account Control Type Of Admin Approval Mode policy. Because this reduces security safeguards, organizations should limit the change to affected devices and document the exception. Windows Server is not affected by this specific connection failure.

What should you do?

Organizations should immediately audit their Remote Desktop Gateway configurations for exposure to CVE-2026-84012. Since the source material does not confirm a specific patch release for this CVE, network segmentation and strict access controls are essential. Monitor connection logs for unusual activity that might indicate exploitation attempts.

What to do and how to stay safe

• Verify if your Remote Desktop Gateway Service is exposed to untrusted networks and restrict access to authorized IP ranges only.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.