This vulnerability (CVE-2026-47654) involves a use-after-free condition in the Remote Desktop Client on Windows Server 2016 (version 10.0.14393.0). An attacker who successfully exploits this flaw could execute arbitrary code remotely without privileges, though user interaction is required. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity and user interaction. Microsoft has issued a temporary fix to address the issue.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on affected Windows Server 2016 systems, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. No known active exploits have been reported.

Microsoft has provided a temporary fix for this vulnerability. Administrators should apply the temporary fix as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654. Monitor the vendor advisory for updates regarding a permanent official fix.