KB5082126: Windows Server 2025 Cumulative Update (May 2026)

An attacker controlling a malicious RDP server can execute code on any Windows Server 2025 host that initiates an outbound RDP session to it (jump boxes, admin workstations, automation hosts). Separately, the unauthenticated TCP/IP RCE puts internet-facing or DMZ-segmented hosts at risk without any user interaction.

KB5082126 bundles all security fixes for Windows Server 2025 since the April 2026 cumulative update. The most severe issue, CVE-2026-32157, allows a malicious RDP server to execute arbitrary code on a connecting client. CVE-2026-33827 is a network-stack RCE in the Windows TCP/IP driver, exploitable without authentication wherever the affected code path is reachable. CVE-2026-32225 is a Windows Shell security feature bypass typically chained with another vulnerability. Cumulative updates must be applied as a complete package.

Probably yes if any of these apply:

Internal red team exercises following the May 2026 disclosure demonstrated the RDP client RCE as a viable lateral-movement path: a compromised file server hosting a malicious RDP shortcut led to SYSTEM-level execution on the admin workstation that opened it. The TCP/IP CVE has no public PoC at time of release but Microsoft rated exploitation "more likely" within 30 days.