CVE-2026-69292: Remote Desktop Gateway Privilege Escalation

CVE-2026-69292 Overview

CVE-2026-69292 is a double free vulnerability [CWE-415] in the Microsoft Remote Desktop Gateway Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected host. The issue was published to the National Vulnerability Database on 2026-09-08 and last updated on 2026-09-09.

Exploitation requires local access, low privileges, and no user interaction, but the attack complexity is high. Successful exploitation compromises confidentiality, integrity, and availability of the target system. Microsoft addressed the vulnerability through its Security Update Guide.

Critical Impact
A successful exploit allows an authenticated local attacker to escalate to higher privileges on a host running the Remote Desktop Gateway Service, providing full control over the affected system.

Affected Products

Microsoft Remote Desktop Gateway Service
Windows Server deployments running the Remote Desktop Gateway role
See the Microsoft Security Update Guide for the authoritative build list

Discovery Timeline

2026-09-08 - CVE-2026-69292 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69292

Vulnerability Analysis

The vulnerability is a double free condition in the Remote Desktop Gateway (RD Gateway) Service. The service frees the same heap allocation twice during processing, corrupting heap metadata and enabling controlled memory reuse. An attacker who wins the required race can steer subsequent allocations to attacker-influenced data.

Heap manipulation of this kind commonly leads to arbitrary write primitives. On Windows services running with elevated tokens, that write primitive translates into code execution in the security context of the service. The RD Gateway Service typically runs with NT AUTHORITY\NETWORK SERVICE or higher, providing a direct path to privilege elevation.

The high attack complexity reflects timing and heap-state requirements. Reliable exploitation requires grooming the heap and racing the second free against a legitimate allocation.

Root Cause

The root cause is improper tracking of ownership for a heap object within the RD Gateway Service, categorized as [CWE-415] Double Free. Two code paths release the same pointer without clearing or reference-counting the allocation. The subsequent free is issued against memory that the allocator has already reissued to another caller.

Attack Vector

The attack vector is local. An attacker must already hold valid low-privileged credentials on the target host and must interact with the RD Gateway Service through local IPC or service interfaces. No user interaction is required. Remote network exploitation is not in scope for this CVE.

Exploitation code is not publicly available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS forecast indicates a low near-term likelihood of exploitation activity.

Detection Methods for CVE-2026-69292

Indicators of Compromise

Unexpected crashes or restarts of the TSGateway service, particularly with heap corruption exceptions (STATUS_HEAP_CORRUPTION, 0xC0000374).
Werfault or WER dumps referencing the RD Gateway Service process during periods of local user activity.
New processes spawned as children of the RD Gateway Service process with elevated tokens.

Detection Strategies

Enable Windows Error Reporting collection and alert on repeated faults in the RD Gateway Service binary.
Monitor Event Log sources Microsoft-Windows-TerminalServices-Gateway and Service Control Manager for abnormal service termination and restart patterns.
Correlate local logon events with subsequent service faults to identify pre-exploitation reconnaissance.

Monitoring Recommendations

Baseline the process tree for the RD Gateway Service and alert on any child process creation.
Track token elevation events (Event ID 4672) for accounts that should not receive privileged tokens.
Forward endpoint telemetry to a centralized analytics platform for cross-host correlation of repeat service crashes.

How to Mitigate CVE-2026-69292

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows Server hosts running the RD Gateway role.
Inventory hosts running the RD Gateway Service and prioritize patching for systems accessible to low-privileged interactive users.
Restrict local logon rights on RD Gateway servers to administrative personnel only.

Patch Information

Microsoft has published the fix through the Security Update Guide. Administrators should consult the vendor advisory for the specific KB article, build numbers, and cumulative update that address CVE-2026-69292 on each supported Windows Server version.

Workarounds

Remove the Remote Desktop Gateway role from servers where it is not required until patches are deployed.
Enforce least privilege for local accounts and remove unnecessary interactive logon rights on RD Gateway hosts.
Segment RD Gateway servers from general-purpose workloads so that local attacker access is minimized.

bash

# Verify whether the RD Gateway role is installed and running
Get-WindowsFeature -Name RDS-Gateway
Get-Service -Name TSGateway | Select-Object Status, StartType

# Remove the role on hosts that do not require it
Uninstall-WindowsFeature -Name RDS-Gateway -Restart