{"id":"CVE-2026-80094","kind":"vulnerability","aliases":["CVE-2026-80094"],"related":[],"title":"Windows Remote Desktop Gateway: use-after-free lets an authorized user gain privileges","description":"Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.","summary":"A memory bug (use after free) in the Remote Desktop Gateway Service lets an attacker who already has valid access over the network raise their privileges. NVD scores it high (CVSS 7.5).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","remote-desktop-gateway","windows"],"not_affected_if":["no-rd-gateway-role"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:22+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:43:04+00:00","updated_at":"2026-11-10T19:43:04+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T19:43:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Remote Desktop Gateway: use-after-free lets an authorized user gain privileges","impact":"high","summary":"A memory bug (use after free) in the Remote Desktop Gateway Service lets an attacker who already has valid access over the network raise their privileges. NVD scores it high (CVSS 7.5).","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","remote-desktop-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with valid network access gains higher system privileges","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-80094 for affected Windows builds, fixed updates and mitigations; NVD data alone gives no version or fix details.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-rd-gateway-role"],"who_is_affected":"Organizations that run the Remote Desktop Gateway role on Windows Server are the ones exposed, since the flaw is in that service. The sources do not say which Windows versions are affected or whether the gateway must be reachable from the internet. Systems that do not run the Remote Desktop Gateway role can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4490,"output_tokens":485,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-80094 for affected Windows builds, fixed updates and mitigations; NVD data alone gives no version or fix details.","search":"'-2026':16A,19A '-80094':17A,20A '7.5':58B 'access':46B 'allow':67C 'alreadi':43B 'attack':41B,70C 'author':11A,69C 'bug':29B 'cve':15A,18A 'cvss':57B 'desktop':3A,24B,36B,64C 'elev':72C 'free':8A,32B,61C 'gain':13A 'gateway':4A,25B,37B,65C 'high':56B 'let':9A,39B 'memori':28B 'network':49B,76C 'nvd':53B 'privileg':14A,52B,73C 'rais':50B 'remot':2A,23B,35B,63C 'remote-desktop-gateway':22B 'score':54B 'servic':38B,66C 'use':6A,30B,59C 'use-after-fre':5A 'user':12A 'valid':45B 'window':1A,26B","nicknames":[],"mitigations":[],"who_affected":"Organizations that run the Remote Desktop Gateway role on Windows Server are the ones exposed, since the flaw is in that service. The sources do not say which Windows versions are affected or whether the gateway must be reachable from the internet. Systems that do not run the Remote Desktop Gateway role can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","other","remotedesktopgateway","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-80094':17A,20A 'author':11A 'cve':15A,18A 'desktop':3A 'free':8A 'gain':13A 'gateway':4A 'let':9A 'privileg':14A 'remot':2A 'use':6A 'use-after-fre':5A 'user':12A 'window':1A","search_b":"'7.5':58B 'access':46B 'alreadi':43B 'attack':41B 'bug':29B 'cvss':57B 'desktop':24B,36B 'free':32B 'gateway':25B,37B 'high':56B 'let':39B 'memori':28B 'network':49B 'nvd':53B 'privileg':52B 'rais':50B 'remot':23B,35B 'remote-desktop-gateway':22B 'score':54B 'servic':38B 'use':30B 'valid':45B 'window':26B","search_c":"'allow':67C 'attack':70C 'author':69C 'desktop':64C 'elev':72C 'free':61C 'gateway':65C 'network':76C 'privileg':73C 'remot':63C 'servic':66C 'use':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-80094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80094","severity":null,"published_at":"2026-11-10T19:21:22+00:00","modified_at":"2026-11-10T19:21:22+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}