Microsoft Issues Critical Security Update for CVE-2026-35535

Microsoft has issued an emergency security update to address CVE-2026-35535, a critical vulnerability in Windows operating systems that could allow attackers to execute arbitrary code remotely. The vulnerability affects all supported versions of Windows, including Windows 10, Windows 11, and Windows Server editions.

The flaw exists in the Windows Remote Desktop Services component, where improper input validation could enable an unauthenticated attacker to send specially crafted requests that trigger memory corruption. Successful exploitation would grant the attacker complete control over the affected system.

Technical Details

The vulnerability carries a CVSS score of 9.8 out of 10, indicating critical severity. Attackers could exploit this flaw without requiring authentication or user interaction. The attack vector is network-based, meaning vulnerable systems exposed to the internet face immediate risk.

Microsoft reports that the vulnerability was discovered during internal security testing. No evidence suggests the flaw was known to or exploited by malicious actors before the patch release.

Affected Systems

• Windows 10 version 1809 and later
• Windows 11 all versions
• Windows Server 2019 and 2022
• Windows Server 2016 (limited support)

Mitigation Steps

Administrators should immediately:

1. Deploy the security update through Windows Update
2. Verify patch installation on all endpoints
3. Monitor network traffic for unusual RDP activity
4. Consider temporarily disabling Remote Desktop Services on exposed systems until patched

The update is available through Windows Update and Microsoft Update Catalog. Systems configured for automatic updates will receive the patch automatically.

Timeline

Microsoft released the security advisory on March 15, 2026, with patches becoming available the same day. The company coordinated the release with security researchers and industry partners to ensure comprehensive coverage.

Additional Resources

• Microsoft Security Update Guide
• CVE-2026-35535 Details
• MSRC Blog Post