Windows Remote Desktop Vulnerability: Microsoft Fixes Four RDP Client Flaws a Malicious Server Could Trigger, and the November 2026 Builds to Install

Microsoft fixed four flaws in the Windows Remote Desktop client on Tuesday, November 10, 2026. Three of them could let an attacker run code on a PC when someone uses it to connect to a malicious Remote Desktop server. If your staff use Remote Desktop or the Windows App to reach office machines, servers or cloud desktops, the computers they connect from need this month's update.

What happened with the Windows Remote Desktop vulnerability

Microsoft's November security release includes four advisories titled "Remote Desktop Client Remote Code Execution Vulnerability." The key word is client. The bugs are in the software people use to connect out to another computer. They are not in the Remote Desktop service that listens for incoming connections on a server.

Microsoft's advisory for the most serious one, CVE-2026-119934, describes the attack. The attacker would need to "host a malicious server and convince a user to connect to it from an affected client." When the client processes the server's response, the attacker could run code on the user's machine.

That changes the usual RDP advice. Keeping your RDP servers behind a VPN is still good practice, but it does not stop these four flaws. The danger is a company laptop connecting out to the wrong server.

The four RDP client CVEs at a glance

Microsoft rates all four as Important, one step below Critical.

What is confirmed and what is not

Confirmed by Microsoft's advisories:

• All four were published on November 10, 2026, and Microsoft says customers must act to fix them.
• None was publicly disclosed before the fix, and none was known to be exploited at release. Microsoft lists the exploit code maturity as "Unproven."
• All three network flaws need the user to take an action, which in practice means connecting to the attacker's server.
• The fixes ship in the November cumulative updates for Windows 10, Windows 11 and Windows Server 2016, 2019, 2022 and 2025.

Not known:

• Microsoft has not released technical details. For CVE-2026-119858, it says particular protocol settings or configurations must be in place but does not say which.
• We found no public proof-of-concept code for any of the four.
• Microsoft does not list Remote Desktop apps for Mac, iPhone or Android in these advisories. We cannot say whether those apps share the same code.

Some news coverage says these flaws let attackers "execute code over network." That is accurate in the scoring sense, but nobody can reach an unpatched PC out of the blue with these bugs. For the three network flaws, someone first has to connect to the attacker's server.

Why this matters for a business network

Tricking people into connecting to a hostile RDP server has already happened. In October 2024, Microsoft reported a spear-phishing campaign by the group it tracks as Midnight Blizzard. The group emailed signed .rdp files to government, academic, defense and nonprofit targets. Opening one of those files connected the victim to the attacker's server and shared their local drives, clipboard and printers with it. That campaign did not use a client bug. A memory flaw like CVE-2026-119934 could give the same kind of lure a direct route to running code.

The machines most at risk are often the most valuable ones. IT staff, managed service providers and developers use Remote Desktop all day, from workstations that can reach every server the business owns.

How to check and fix it this week

Install the build below, or anything newer, on every PC and server:

Your checklist:

1. Patch the PCs that connect, not only the servers. Install the November cumulative update and restart. An update that is installed but still waiting for a restart has not fixed anything.
2. Check the build. Press Windows+R, type winver and press Enter. The OS Build number should match or beat the table. For a fleet, use the patch report in Intune, WSUS or your management tool.
3. Update the Windows App. Microsoft released version 2.0.1489.0 on November 10, 2026. Its release notes list security fixes, including CVE-2026-119934, CVE-2026-119858 and CVE-2026-95964.
4. Restrict outbound RDP. Block TCP port 3389 from your network to the internet and allow only the destinations your business actually uses. Microsoft recommended limiting outbound RDP to external networks after the 2024 campaign.
5. Stop .rdp files in email. Block or quarantine .rdp attachments at your email gateway. Very few businesses need to receive them from outside.
6. Tell staff one rule. Real Remote Desktop connections come from IT, not from an email, chat message or link.
7. Keep inbound RDP off the open internet. It does not prevent these flaws, but it still protects against server-side attacks.

Remote Desktop vulnerability questions people are asking

Is the November 2026 RDP vulnerability being exploited?

Not as far as anyone knows. As of November 10, 2026, Microsoft lists all four as not exploited and not publicly disclosed.

Do I need to patch if Remote Desktop is turned off?

Yes. These flaws are in the client, which is built into every supported version of Windows. Turning off incoming Remote Desktop connections does not remove the client.

Does a VPN protect against these RDP flaws?

Not directly. A VPN protects servers that accept connections. These flaws are triggered when a user connects out to a hostile server.

What is the fixed Windows 11 build?

26100.9974 for 24H2, 26200.9974 for 25H2 and 26300.9974 for 26H2, or the .9911 builds from KB5132043. For 23H2 it is 22631.7711.

Is the Windows App affected?

Update the Windows App to 2.0.1489.0 or later. Microsoft's advisory for CVE-2026-119390 names that build as the fix.

Is Remote Desktop on Mac or phones affected?

Microsoft's advisories list Windows and the Windows App for Windows desktop only. They say nothing either way about other platforms.

The bigger lesson

Patching plans usually start with the servers that face the internet. These flaws show that the tools your team uses to reach those servers can be attacked too. The admin laptop that connects to everything deserves the same patch schedule, outbound firewall rules and email filtering as the servers it manages.

To get your devices and remote access locked down, see security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Microsoft CVE-2026-119934; Microsoft CVE-2026-119858; Microsoft CVE-2026-95964; Microsoft CVE-2026-119390; Microsoft Learn: What's new in Windows App; Microsoft Threat Intelligence: Midnight Blizzard RDP campaign.