Loading vulnerability…
Remote Code Execution in Microsoft Remote Desktop Client
CVE-2025-26645 is a relative path traversal vulnerability in Microsoft Remote Desktop Client. An attacker controlling a Remote Desktop Protocol server can execute code on a vulnerable Remote Desktop client when an administrator or other vulnerable client connects to that server.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables remote code execution on the connecting vulnerable Remote Desktop client.
If you can’t patch tonight, do this now.
Until updates are deployed, prevent users and administrators from connecting Remote Desktop Client instances to untrusted or attacker-controlled RDP servers.
Patch, then assume compromise.
Install the Microsoft March 2025 security updates applicable to affected Windows systems and Remote Desktop Client deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.