Windows Server 2016 (< 10.0.14393.7159) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/windows-server-2016--10.0.14393.7159/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 05:01:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft Windows RDL Service Remote Code Execution (CVE-2024-38077)https://feed.craftedsignal.io/briefs/2026-10-cve-2024-38077/Sat, 24 Oct 2026 05:01:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2024-38077/A publicly available proof-of-concept for CVE-2024-38077 targets the Windows Remote Desktop Licensing (RDL) service over RPC port 135 to identify vulnerable Windows Server systems.CVE-2024-38077 is a critical vulnerability impacting the Microsoft Windows Remote Desktop Licensing (RDL) service. An exploit PoC has been released publicly that utilizes RPC connections on port 135 to determine if a target host is vulnerable. The vulnerability has a CVSS 3.1 score of 9.8. Documentation indicates that patched versions of Windows Server 2016 and 2019 return an "nca_s_fault_access_denied" error during RPC probing, whereas unpatched systems or legacy versions (2008/2012) may behave differently.

Impact

The vulnerability allows unauthenticated, network-based remote code execution. The EPSS score is 84.2 percent, reflecting a high probability of exploitation.

Recommendation

  • Immediately patch Windows Server 2016 to build 10.0.14393.7159 or later.
  • Immediately patch Windows Server 2019 to build 10.0.17763.6054 or later.
  • Restrict access to RPC port 135 via host-based and network firewalls to only necessary administrative management stations.
  • Implement the hunt leads provided in this brief to identify internal scanning or reconnaissance activity targeting port 135.
]]>criticaladvisory