Advisory · CVE-2026-100218
Use-after-free in Remote Desktop Gateway can give unauthenticated code execution
The Windows Remote Desktop Gateway service has a use-after-free flaw an unauthenticated attacker can use over the network to execute code. Microsoft rates it CVSS 3.1 8.1.
- Vendor
- Microsoft
- Product
- Remote Desktop Gateway
- Identifier / CWE
- CVE-2026-100218
CWE-416 - Action timing
- Immediate
Explain it like I’m five
The front door for remote workers frees memory and keeps using it, and a stranger knocking in the right rhythm can move in.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Remote Desktop Gateway.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-100218 in its October 2026 update guide: a use-after-free weakness (CWE-416) in the Remote Desktop Gateway Service lets an unauthorized attacker execute code over a network.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Remote Desktop Gateway deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Remote Desktop Gateway while remediation is underway, especially for internet-facing instances.
- Review application and server logs for RD Gateway service crashes, connection floods, and logins from unfamiliar sources after instability.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
RD Gateway is internet-facing by design in many estates. An unauthenticated flaw there goes to the front of the patch queue.