Threat reportVulnerabilityTL-2026-3828
RDP Gateway pre-auth RCE via UDP fragment reassembly flaws (CVE-2020-0609, CVE-2020-0610)
RDP Gateway pre-auth RCE via UDP fragment reassembly flaws (TL-2026-3828), also tracked as BlueGate, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows Server (Remote Desktop Gateway role), references 2 CVEs (CVE-2020-0609, CVE-2020-0610), maps to 4 MITRE ATT&CK techniques (T1133, T1190, T1499.004), and is covered by 9 detection rules and 9 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3828
- Threat ID
- TL-2026-3828
- Also known as
- BlueGate
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
Malware and tooling: BlueGate, RDGScanner
How RDP Gateway pre-auth RCE via UDP fragment reassembly flaws works
Two separate pre-authentication remote code execution bugs in the Windows Remote Desktop Gateway (RD Gateway) UDP transport (default UDP/3391). CVE-2020-0609 is a bounds-checking failure in fragment reassembly that allows writes of up to 999 bytes at attacker-controlled heap offsets; CVE-2020-0610 is an out-of-bounds array write when tracking received fragments. Microsoft patched both in the January 2020 security update; public DoS PoC and scanner code (BlueGate, RDGScanner) followed within two weeks.
Windows Remote Desktop Gateway (Terminal Services Gateway) brokers RDP connections over HTTP, HTTPS and a UDP transport. Kryptos Logic analyzed the UDP handler and found two distinct memory-corruption flaws reachable before authentication and with no user interaction. The RDG-UDP protocol splits large messages across multiple UDP packets that may arrive out of order; each packet carries a fragment_id (position), num_fragments (total) and fragment_length. The reassembly logic fails to properly validate these attacker-supplied values.
CVE-2020-0609 (heap out-of-bounds write): the reassembly buffer is allocated at 1000 bytes and each fragment is copied with memcpy_s to an offset computed as fragment_id x 1000, but the bounds check ignores that offset. An attacker can therefore write 999 bytes to any offset from 1 up to roughly 65,534,000 bytes beyond the end of the buffer. This is a precise, controlled write primitive rather than a linear overflow.
CVE-2020-0610 (out-of-bounds array write): the array that records which fragments have been received has only 64 entries, yet fragment_id may range from 0 to 65535. Any fragment_id between 65 and 65535 writes a 1 (TRUE) outside the array bounds, giving a single-byte out-of-bounds write that can alter program behavior.
Exploitation status: neither the Kryptos Logic post nor NVD states in-the-wild exploitation, and no threat actor attribution is reported. On 2020-01-26 a researcher using the pseudonym Ollypwn published BlueGate on GitHub, a PoC that can cause denial of service and includes a vulnerability check mode; Marcus Hutchins (MalwareTech) published RDGScanner, which detects vulnerable servers by sending a CONNECT_PKT_FRAGMENT message with num_fragments above 64 (patched hosts disconnect with error 0x8000ffff, vulnerable hosts allow the connection). Qualys reported that a researcher had developed a working RCE exploit that had not been publicly released, and that over 15,000 vulnerable RD Gateway servers were reachable online at the time of reporting. Exposure requires inbound TCP/443 plus UDP/3391 to the gateway. Mitigations from the source: install the January 2020 update, or disable UDP transport in the RD Gateway settings / firewall UDP/3391.
MITRE ATT&CK techniques used in TL-2026-3828
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1499.004 Application or System Exploitation
Reconnaissance
Affected products and versions in RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
- Microsoft — Windows Server (Remote Desktop Gateway role)
Vulnerable versions: 2012; 2012 R2; 2016; 2019
Fixed in: 2012 with KB4534283/KB4534288; 2012 R2 with KB4534297/KB4534309; 2016 with KB4534271; 2019 with KB4534273
Remediation for RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
Patches
- Windows Server 2012: KB4534283 (Monthly Rollup) / KB4534288 (Security-Only)
- Windows Server 2012 R2: KB4534297 (Monthly Rollup) / KB4534309 (Security-Only)
- Windows Server 2016: KB4534271
- Windows Server 2019: KB4534273
Immediate actions
- Install the January 2020 Microsoft security update on every Windows Server running the RD Gateway role
- If patching is not possible, disable UDP Transport in the RD Gateway settings
- Firewall inbound UDP/3391 to RD Gateway servers
Workarounds
- Disable UDP Transport in RD Gateway
- Block UDP port 3391 at the perimeter
Longer-term hardening
- Inventory internet-exposed RD Gateway servers and restrict exposure to required source ranges
- Monitor UDP/3391 traffic to RD Gateway hosts for malformed or abnormal fragment parameters and for gateway process crashes
CVEs associated with RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
Weaknesses (CWE) in RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
Timeline of RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
- Microsoft releases January 2020 Patch Tuesday updates fixing CVE-2020-0609 and CVE-2020-0610 in Windows Remote Desktop Gateway; NVD publishes both CVEs with CVSS 3.1 score 9.8.
- Kryptos Logic publishes 'RDP to RCE: When Fragmentation Goes Wrong' detailing the UDP fragment reassembly heap out-of-bounds write (0609) and the 64-entry array out-of-bounds write (0610).
- Press reports over 15,000 vulnerable RD Gateway servers reachable from the internet at the time of reporting.
- Marcus Hutchins (MalwareTech) releases RDGScanner, which detects vulnerable gateways by sending a CONNECT_PKT_FRAGMENT with num_fragments above 64.
- Researcher Ollypwn publishes the BlueGate PoC on GitHub, providing a denial-of-service mode and a vulnerability check mode for both CVEs.
- Qualys ThreatPROTECT publishes patch/KB mapping and detection (QID 91596), noting a working RCE exploit exists privately but has not been publicly released.
Sources cited for RDP Gateway pre-auth RCE via UDP fragment reassembly flaws
- RDP to RCE: When Fragmentation Goes Wrong
- NVD - CVE-2020-0609
- NVD - CVE-2020-0610
- Microsoft MSRC - CVE-2020-0609
- Microsoft MSRC - CVE-2020-0610
- Qualys ThreatPROTECT - Microsoft Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerabilities
- BlueGate PoC (ollypwn) - DoS and check mode for CVE-2020-0609/0610
- RDGScanner (MalwareTech) - scanner for CVE-2020-0609/0610
- SecurityLab.ru - Exploits published for critical Windows RD Gateway vulnerabilities
Detection coverage for TL-2026-3828
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3828 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.