CVE-2024-49129 Overview
CVE-2024-49129 is a denial of service vulnerability in the Windows Remote Desktop Gateway (RD Gateway) role service. Microsoft published the advisory on December 12, 2024 as part of its monthly security release. The flaw affects supported Windows Server versions running the RD Gateway role, which brokers external Remote Desktop Protocol (RDP) connections into corporate networks. An attacker with low privileges can send crafted network traffic to the gateway to disrupt its availability. The weakness is tracked under CWE-400 (uncontrolled resource consumption) and CWE-362 (concurrent execution using shared resource with improper synchronization, a race condition).
Critical Impact
Successful exploitation can render the RD Gateway service unresponsive, blocking legitimate remote sessions and impacting availability for organizations that depend on RD Gateway for external RDP access.
Affected Products
- Microsoft Windows Server 2012 and Windows Server 2012 R2
- Microsoft Windows Server 2016 and Windows Server 2019
- Microsoft Windows Server 2022 and Windows Server 2025
Discovery Timeline
- 2024-12-12 - CVE-2024-49129 published to the National Vulnerability Database (NVD)
- 2024-12-12 - Microsoft released security updates addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49129
Vulnerability Analysis
CVE-2024-49129 is a denial of service condition in the RD Gateway service. The service accepts inbound RDP-over-HTTPS connections from remote clients and proxies them to internal Remote Desktop hosts. The bug combines two weakness classes: uncontrolled resource consumption ([CWE-400]) and a race condition ([CWE-362]) between concurrent request handlers. An authenticated attacker with a low-privileged account can send specifically ordered requests that trigger the race window and exhaust gateway resources.
Microsoft classifies the attack complexity as high because reliable exploitation requires precise timing to hit the race condition. The vulnerability does not require user interaction and is exploitable over the network. Microsoft's advisory does not attribute in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper synchronization in RD Gateway request-processing paths. Concurrent connections can enter a state where shared resources are accessed without adequate locking, leading to resource exhaustion or a service crash. Because RD Gateway is a Windows Server role, the vulnerable code path ships with every supported Windows Server release listed in Microsoft's advisory.
Attack Vector
The attack is remote and network-based. An attacker who can reach the RD Gateway endpoint, typically TCP 443 exposed to the internet, sends crafted concurrent requests that trigger the race condition. Successful exploitation stops the gateway from servicing legitimate RDP sessions until the service is restarted or recovers. No public proof-of-concept code is available at the time of writing.
Refer to the Microsoft CVE-2024-49129 Update Guide for authoritative technical details.
Detection Methods for CVE-2024-49129
Indicators of Compromise
- Unexpected termination or repeated restarts of the TSGateway service on RD Gateway hosts.
- Spikes in half-open or unfinished RDP-over-HTTPS connections on TCP 443 targeting the gateway.
- Sudden loss of connectivity for external RDP users while internal Remote Desktop hosts remain reachable.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-TerminalServices-Gateway/Operational and the System log for service crash and recovery events.
- Correlate abnormal RD Gateway CPU, memory, and handle counts with concurrent inbound connection bursts.
- Alert on anomalous concurrency patterns from a single source IP or narrow set of IPs against the RD Gateway endpoint.
Monitoring Recommendations
- Aggregate RD Gateway logs into a centralized SIEM or data lake for cross-host correlation and long-term retention.
- Baseline normal connection rates per client and alert on statistical outliers.
- Track patch state of all Windows Server hosts running the RD Gateway role and flag any unpatched systems exposed to the internet.
How to Mitigate CVE-2024-49129
Immediate Actions Required
- Apply the December 2024 Microsoft security updates that address CVE-2024-49129 to every affected Windows Server host running the RD Gateway role.
- Inventory all internet-facing RD Gateway endpoints and prioritize them in the patch schedule.
- Restrict inbound access to RD Gateway to known client networks or place the service behind a VPN or Zero Trust access broker where feasible.
Patch Information
Microsoft published fixes for all affected Windows Server releases in the December 12, 2024 security update. Consult the Microsoft CVE-2024-49129 Update Guide for the specific KB article and build numbers that apply to each supported Windows Server version.
Workarounds
- Rate-limit inbound connections to the RD Gateway at an upstream load balancer or web application firewall to reduce race-condition exposure.
- Enforce strong authentication such as multifactor authentication (MFA) and Network Level Authentication (NLA) to reduce the pool of attackers who can reach the vulnerable code path.
- Where RD Gateway is not required, disable the TSGateway role to remove exposure entirely.
# Verify RD Gateway service state and installed updates on Windows Server
Get-Service TSGateway
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
