PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84007 Microsoft CVE debrief

The CVE-2026-84007 Remote Desktop Gateway Service Information Disclosure Vulnerability allows an authorized attacker to disclose information over a network due to an out-of-bounds read in the Remote Desktop Gateway Service. This vulnerability has a CVSS score of 6.5 and is considered medium severity. Affected products include various versions of Windows Server from 2012 to 2025, including both standard and Server Core installations.

Vendor
Microsoft
Product
Windows Server 2012
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-13
Advisory published
2026-10-13
Advisory updated
2026-10-13

Who should care

System administrators and defenders responsible for Windows Server deployments, especially those using Remote Desktop Gateway Service, should assess their exposure and prioritize patching.

Why it matters

CVE-2026-84007 is a medium-severity vulnerability in the Remote Desktop Gateway Service that allows information disclosure. Defenders should prioritize patching, restrict access, and monitor network activity to mitigate potential impacts.

  • Defenders need to verify if their Windows Server installations are affected and apply patches accordingly.
  • System administrators should restrict access to the Remote Desktop Gateway Service to minimize the attack surface.
  • Monitoring network activity may help detect potential information disclosure attempts.

Technical summary

The vulnerability is caused by an out-of-bounds read in the Remote Desktop Gateway Service, allowing an authorized attacker to disclose information over a network. This issue affects multiple versions of Windows Server, including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, as well as their Server Core installations.

Defensive priority

Defenders should prioritize patching this vulnerability, especially for Windows Server installations that are exposed to the network or used by authorized users.

Recommended defensive actions

  • Apply patches from Microsoft for the affected Windows Server versions.
  • Restrict access to the Remote Desktop Gateway Service to only necessary users.
  • Monitor network activity for potential information disclosure attempts.

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Microsoft has released a patch for this issue, which is available through their update guide.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84007 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84007

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84007 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84007

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.