---
id: "CVE-2026-80094"
page: "https://infrastack.ai/live/CVE-2026-80094"
kind: "vulnerability"
aliases: ["CVE-2026-80094"]
title: "Windows Remote Desktop Gateway: use-after-free lets an authorized user gain privileges"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Windows Server 2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "microsoft"}, {"name": "Windows Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["other", "rd-gateway", "remote-desktop-gateway", "self-hosted", "windows", "windows-server"]
not_affected_if: ["no-rd-gateway-role"]
published_at: "2026-11-10T19:21:22+00:00"
first_seen_at: "2026-11-10T19:25:17+00:00"
updated_at: "2026-11-10T21:12:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80094", "first_seen_at": "2026-11-10T19:25:17+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-80094", "first_seen_at": "2026-11-10T21:12:41+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-80094"]}]
exploit_sources: []
---

# Windows Remote Desktop Gateway: use-after-free lets an authorized user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-80094 (this .md is for agents)

Use after free in the Remote Desktop Gateway Service lets an authenticated attacker with low privileges raise privileges over the network (CVSS 7.5, attack complexity high). Fixed in Microsoft's November 2026 updates for Windows Server 2016 to 2025. No exploitation reported at publication (CVSS temporal E:U).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows Server 2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- microsoft:Windows Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- microsoft:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- microsoft:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822

## How to check

Only matters if the Remote Desktop Gateway role is installed: Get-WindowsFeature RDS-Gateway in PowerShell. If installed, compare the OS build (winver or [Environment]::OSVersion) with the fixed builds: Server 2016 < 10.0.14393.9688, 2019 < 10.0.17763.9487, 2022 < 10.0.20348.5870, 2025 < 10.0.26100.33822.

## Fix

Install the November 2026 Windows cumulative update: Server 2016 10.0.14393.9688, Server 2019 10.0.17763.9487, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822 (builds per Microsoft CNA record; KB numbers not confirmed)

## Timeline

- 2026-11-10T19:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-80094
- 2026-11-10T21:12:41+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-80094 — Read Microsoft CNA data via NVD (MSRC update guide page is JS-only, not readable; KB numbers not read). Per-build ranges and fixed builds from that record. Not verified: no MSRC page read. No exploitation info; X/social not searched.

## Documents

- [describes] NVD CVE-2026-80094 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-80094

## From the sources

Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_