{"id":"CVE-2026-69327","kind":"vulnerability","aliases":["CVE-2026-69327"],"related":[],"title":"Windows Remote Desktop Gateway: use-after-free lets an attacker run code","description":"Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code locally.","summary":"A use-after-free bug in the Windows Remote Desktop Gateway Service lets an unauthorized attacker run code on the affected machine. The attack is local, so the attacker needs access to the host itself.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","remote-desktop-gateway","windows"],"not_affected_if":["no-rd-gateway-role"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:47:34+00:00","updated_at":"2026-11-10T19:47:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:47:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Remote Desktop Gateway: use-after-free lets an attacker run code","impact":"high","summary":"A use-after-free bug in the Windows Remote Desktop Gateway Service lets an unauthorized attacker run code on the affected machine. The attack is local, so the attacker needs access to the host itself.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-desktop-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs code on the gateway server","analyst_note":"Confirm affected Windows Server builds, patch availability and whether exploitation requires network access, using the Microsoft advisory for CVE-2026-69327.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rd-gateway-role"],"who_is_affected":"Organizations running the Remote Desktop Gateway role on Windows Server. The sources do not state affected versions or whether the flaw is reachable remotely.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":4486,"output_tokens":427,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows Server builds, patch availability and whether exploitation requires network access, using the Microsoft advisory for CVE-2026-69327.","search":"'-2026':15A,18A '-69327':16A,19A 'access':57B 'affect':47B 'allow':69C 'attack':11A,42B,50B,55B,72C 'bug':31B 'code':13A,44B,75C 'cve':14A,17A 'desktop':3A,23B,36B,66C 'execut':74C 'free':8A,30B,63C 'gateway':4A,24B,37B,67C 'host':60B 'infrastructur':20B 'let':9A,39B 'local':52B,76C 'machin':48B 'need':56B 'remot':2A,22B,35B,65C 'remote-desktop-gateway':21B 'run':12A,43B 'servic':38B,68C 'unauthor':41B,71C 'use':6A,28B,61C 'use-after-fre':5A,27B 'window':1A,25B,34B","nicknames":[],"mitigations":[],"who_affected":"Organizations running the Remote Desktop Gateway role on Windows Server. The sources do not state affected versions or whether the flaw is reachable remotely.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","remotedesktopgateway","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-69327':16A,19A 'attack':11A 'code':13A 'cve':14A,17A 'desktop':3A 'free':8A 'gateway':4A 'let':9A 'remot':2A 'run':12A 'use':6A 'use-after-fre':5A 'window':1A","search_b":"'access':57B 'affect':47B 'attack':42B,50B,55B 'bug':31B 'code':44B 'desktop':23B,36B 'free':30B 'gateway':24B,37B 'host':60B 'infrastructur':20B 'let':39B 'local':52B 'machin':48B 'need':56B 'remot':22B,35B 'remote-desktop-gateway':21B 'run':43B 'servic':38B 'unauthor':41B 'use':28B 'use-after-fre':27B 'window':25B,34B","search_c":"'allow':69C 'attack':72C 'code':75C 'desktop':66C 'execut':74C 'free':63C 'gateway':67C 'local':76C 'remot':65C 'servic':68C 'unauthor':71C 'use':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69327","severity":null,"published_at":"2026-11-10T19:21:19+00:00","modified_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}