Microsoft Windows RDL Service Remote Code Execution (CVE-2024-38077)
A publicly available proof-of-concept for CVE-2024-38077 targets the Windows Remote Desktop Licensing (RDL) service over RPC port 135 to identify vulnerable Windows Server systems.
CVE search metadata
CVE search record: CVE-2024-38077. Severity: critical. CVSS: 9.8. EPSS: 84.23%. KEV: no. Product: Windows Server 2008 (All versions), Windows Server 2012 (All versions), Windows Server 2016 (< 10.0.14393.7159), Windows Server 2019 (< 10.0.17763.6054). Brief: Microsoft Windows RDL Service Remote Code Execution (CVE-2024-38077). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2024-38077/
Triage facts
Revision 1- Applicability
- Windows Server 2008 (All versions), Windows Server 2012 (All versions) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 24, 05:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B3Likely
CVE-2024-38077 is a critical vulnerability impacting the Microsoft Windows Remote Desktop Licensing (RDL) service. An exploit PoC has been released publicly that utilizes RPC connections on port 135 to determine if a target host is vulnerable. The vulnerability has a CVSS 3.1 score of 9.8. Documentation indicates that patched versions of Windows Server 2016 and 2019 return an "nca_s_fault_access_denied" error during RPC probing, whereas unpatched systems or legacy versions (2008/2012) may behave differently.
Impact
The vulnerability allows unauthenticated, network-based remote code execution. The EPSS score is 84.2 percent, reflecting a high probability of exploitation.
Recommendation
- Immediately patch Windows Server 2016 to build 10.0.14393.7159 or later.
- Immediately patch Windows Server 2019 to build 10.0.17763.6054 or later.
- Restrict access to RPC port 135 via host-based and network firewalls to only necessary administrative management stations.
- Implement the hunt leads provided in this brief to identify internal scanning or reconnaissance activity targeting port 135.
Immediate actions
Patch affected Windows Server 2016 and 2019 instances to the identified safe build versions.
Threat Hunt
Identify unusual internal scanning patterns targeting TCP/135.
Data: Firewall logs, NetFlow / VPC Flow logs
Mitigations
Implement firewall rules restricting inbound access to TCP/135 to trusted management IP addresses only.
CVE-2024-38077