{"id":"CVE-2026-69565","kind":"vulnerability","aliases":["CVE-2026-69565"],"related":[],"title":"Windows Remote Desktop Gateway: use-after-free lets an authorized user run code","description":"Use after free in Remote Desktop Gateway Service allows an authorized attacker to execute code locally.","summary":"A memory-handling bug in the Remote Desktop Gateway Service lets an attacker who already has authorized access run code on the local machine. The sources do not name a vendor product string or version range.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","remote-desktop-gateway","windows"],"not_affected_if":["no-rd-gateway"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","triaged_at":"2026-11-10T19:50:09+00:00","updated_at":"2026-11-10T19:50:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:50:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Remote Desktop Gateway: use-after-free lets an authorized user run code","impact":"high","summary":"A memory-handling bug in the Remote Desktop Gateway Service lets an attacker who already has authorized access run code on the local machine. The sources do not name a vendor product string or version range.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","remote-desktop-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with valid access runs code on the server","analyst_note":"Find the Microsoft advisory for CVE-2026-69565 to confirm affected Windows builds, the fixed update, and whether the flaw is reachable beyond local access.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rd-gateway"],"who_is_affected":"Systems running the Remote Desktop Gateway Service are in scope, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or configurations are affected, so unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":4482,"output_tokens":440,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-69565 to confirm affected Windows builds, the fixed update, and whether the flaw is reachable beyond local access.","search":"'-2026':16A,19A '-69565':17A,20A 'access':45B 'allow':72C 'alreadi':42B 'attack':40B,75C 'author':11A,44B,74C 'bug':31B 'code':14A,47B,78C 'cve':15A,18A 'desktop':3A,24B,35B,69C 'execut':77C 'free':8A,66C 'gateway':4A,25B,36B,70C 'handl':30B 'infrastructur':21B 'let':9A,38B 'local':50B,79C 'machin':51B 'memori':29B 'memory-handl':28B 'name':56B 'product':59B 'rang':63B 'remot':2A,23B,34B,68C 'remote-desktop-gateway':22B 'run':13A,46B 'servic':37B,71C 'sourc':53B 'string':60B 'use':6A,64C 'use-after-fre':5A 'user':12A 'vendor':58B 'version':62B 'window':1A,26B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Remote Desktop Gateway Service are in scope, and the attacker must already be authorized on the machine. The sources do not say which Windows versions or configurations are affected, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","remotedesktopgateway","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-69565':17A,20A 'author':11A 'code':14A 'cve':15A,18A 'desktop':3A 'free':8A 'gateway':4A 'let':9A 'remot':2A 'run':13A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A","search_b":"'access':45B 'alreadi':42B 'attack':40B 'author':44B 'bug':31B 'code':47B 'desktop':24B,35B 'gateway':25B,36B 'handl':30B 'infrastructur':21B 'let':38B 'local':50B 'machin':51B 'memori':29B 'memory-handl':28B 'name':56B 'product':59B 'rang':63B 'remot':23B,34B 'remote-desktop-gateway':22B 'run':46B 'servic':37B 'sourc':53B 'string':60B 'vendor':58B 'version':62B 'window':26B","search_c":"'allow':72C 'attack':75C 'author':74C 'code':78C 'desktop':69C 'execut':77C 'free':66C 'gateway':70C 'local':79C 'remot':68C 'servic':71C 'use':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69565","severity":null,"published_at":"2026-11-10T19:21:19+00:00","modified_at":"2026-11-10T19:21:19+00:00","first_seen_at":"2026-11-10T19:25:16+00:00","fetched_at":"2026-11-10T19:25:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}