CVE-2026-70033: Windows 10 Version 1607 10.0.14393.0 to before 10.0.14393.9612; +12 more affected products

Affected technology

Windows 10 Version 1607 · 10.0.14393.0 to before 10.0.14393.9612
Microsoft

Windows 10 Version 1809 · 10.0.17763.0 to before 10.0.17763.9376
Microsoft

Windows Server 2012 · 6.2.9200.0 to before 6.2.9200.26434
Microsoft

Windows Server 2012 (Server Core installation) · 6.2.9200.0 to before 6.2.9200.26434
Microsoft

Windows Server 2012 R2 · 6.3.9600.0 to before 6.3.9600.23470
Microsoft

Windows Server 2012 R2 (Server Core installation) · 6.3.9600.0 to before 6.3.9600.23470
Microsoft

Windows Server 2016 · 10.0.14393.0 to before 10.0.14393.9612
Microsoft

Windows Server 2016 (Server Core installation) · 10.0.14393.0 to before 10.0.14393.9612
Microsoft

Windows Server 2019 · 10.0.17763.0 to before 10.0.17763.9376
Microsoft

Windows Server 2019 (Server Core installation) · 10.0.17763.0 to before 10.0.17763.9376
Microsoft

Windows Server 2022 · 10.0.20348.0 to before 10.0.20348.5761
Microsoft

Windows Server 2025 · 10.0.26100.0 to before 10.0.26100.33650
Microsoft

Windows Server 2025 (Server Core installation) · 10.0.26100.0 to before 10.0.26100.33650
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.