CVE-2026-20841 (CVSS 9.8) Remote Code Execution in Windows

Back Purple-Ops

CVE-2026-20841 (CVSS 9.8) Remote Code Execution in Windows

Purple-Ops • February 12, 2026

Share: View original

Key Takeaways: Critical vulnerability in Windows Remote Procedure Call (RPC) with a CVSS score of 9.8. Allows for unauthenticated Remote Code ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Windows Notepad and RPC Identified CVE-2026-20841, a critical vulnerability with a CVSS score of 9.8, affects Windows Remote Procedure Call (RPC) and allows unauthenticated remote code execution. Additionally, a related issue in Windows Notepad, with a CVSS score of 8.8, enables remote code execution via malicious Markdown files. Both vulnerabilities were published on February 10, 2026, with proof of concept released the following day. 3 sources 58

Extracted Entities

Attack Types (2)

Remote Code Execution Zero-day Exploit

CVEs (1)

Platforms (1)