CVE-2022-21851: Windows 10 Remote Desktop RCE Vulnerability

CVE-2022-21851 Overview

CVE-2022-21851 is a remote code execution vulnerability in the Microsoft Windows Remote Desktop Client. An attacker who controls a malicious Remote Desktop Protocol (RDP) server can execute arbitrary code on a connecting client when a user initiates an RDP session to the attacker-controlled host. The flaw affects supported versions of Windows desktop and Windows Server, including Windows 7, 8.1, 10, 11, Server 2008, 2012, 2016, 2019, and Server 2022. Microsoft addressed the issue through the January 2022 Patch Tuesday security updates.

Critical Impact
A successful attack yields code execution in the context of the connecting user on the RDP client host, enabling lateral movement, credential theft, and follow-on compromise.

Affected Products

Microsoft Windows 10 (1607, 1809, 1909, 20H2, 21H1, 21H2) — x86, x64, ARM64
Microsoft Windows 11 — x64, ARM64
Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, and Server 20H2

Discovery Timeline

2022-01-11 - CVE-2022-21851 published to the National Vulnerability Database (NVD)
2022-01-11 - Microsoft released security updates addressing the vulnerability
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21851

Vulnerability Analysis

The vulnerability resides in the Windows Remote Desktop Client and is reachable over the network. Exploitation requires user interaction: a victim must connect to an RDP server controlled by the attacker. Successful exploitation results in remote code execution on the client machine with the privileges of the user running the RDP client. Because the impact applies to confidentiality, integrity, and availability, an attacker can run arbitrary code, modify data, and disrupt the affected system. The CWE classification is recorded as NVD-CWE-noinfo, reflecting Microsoft's standard practice of withholding root-cause details for client-side RDP flaws.

Root Cause

Microsoft has not published the underlying defect class. The advisory describes the issue only as a remote code execution flaw in the Remote Desktop Client component (mstsc.exe and supporting RDP client libraries). Client-side RDP RCE vulnerabilities in this class typically stem from memory-safety issues in code that parses server-originated virtual channel data.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts a hostile RDP server and lures a target to connect, often through phishing links, malicious .rdp files, or compromised infrastructure that a user is expected to administer. Once the client establishes the session, malicious server responses trigger the vulnerable code path in the client, leading to code execution on the victim host. The vulnerability does not require prior authentication on the target client. The attack technique inverts the typical RDP threat model, in which the server is normally the asset under attack.

No public proof-of-concept exploit has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS data indicates a non-trivial probability of exploitation activity relative to the broader CVE population.

Detection Methods for CVE-2022-21851

Indicators of Compromise

Outbound TCP connections from workstations on port 3389 (or non-standard RDP ports) to untrusted external IP addresses or recently registered domains.
Unexpected child processes spawned by mstsc.exe, especially shells (cmd.exe, powershell.exe) or LOLBins such as rundll32.exe and regsvr32.exe.
Creation or execution of .rdp files delivered via email, chat, or web download immediately preceding suspicious process activity.

Detection Strategies

Hunt for process lineage where mstsc.exe is the parent of script interpreters or living-off-the-land binaries within minutes of an outbound RDP session.
Correlate RDP client launches with subsequent file writes to %TEMP%, %APPDATA%, or auto-start locations on the same endpoint.
Alert on RDP sessions initiated to public IP ranges that fall outside approved jump-host or administrative destinations.

Monitoring Recommendations

Enable command-line and process-creation auditing (Event ID 4688) and ship telemetry to a centralized SIEM or data lake.
Monitor egress firewall logs for outbound RDP to the public internet and treat such flows as policy violations by default.
Track Microsoft Defender / EDR detections that reference mstsc.exe or RDP virtual channel components as the impacted process.

How to Mitigate CVE-2022-21851

Immediate Actions Required

Apply the January 11, 2022 Microsoft security updates to every affected Windows desktop and server build identified in the advisory.
Block outbound TCP/3389 at the perimeter and on host firewalls except where business justification and an approved destination exist.
Restrict use of the Remote Desktop Client to vetted administrative endpoints and enforce least-privilege accounts for RDP operators.

Patch Information

Microsoft released fixes through the January 2022 cumulative updates. Refer to the Microsoft CVE-2022-21851 Update Guide and the Microsoft Security Advisory for CVE-2022-21851 for the specific KB articles aligned to each Windows build. Confirm that the appropriate update is installed by reviewing the Windows Update history or by querying Get-HotFix on the host.

Workarounds

Where patching must be delayed, disable or remove the Remote Desktop Client from user workstations that do not require it.
Use Group Policy and AppLocker or Windows Defender Application Control to block execution of .rdp files originating from untrusted locations such as email attachments and downloads.
Route administrative RDP connections exclusively through hardened jump hosts and require multi-factor authentication at the gateway.

bash

# Configuration example: block outbound RDP from a workstation using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Block Outbound RDP" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 3389 `
  -Action Block `
  -Profile Any