Remote Code Execution (RCE).

What Is Remote Code Execution?

Remote code execution (RCE) is when an attacker runs code of their choice on another person’s system from a distance. It is also called arbitrary code execution. The word “remote” means the attacker does not need to sit at the machine. The word “arbitrary” means the attacker, not the owner, picks the code.

A remote code execution vulnerability is a weakness in software that makes this possible. A current example in PHP itself is PHP2Shell, two critical PHP core flaws (CVE-2026-109618 and CVE-2026-109619). In Next.js, CVE-2026-96889 in the Next.js Image Optimization API is another example. In Node.js, CVE-2026-111497, an out-of-bounds write in the Brotli decoder (Node2Shell), is a recent one, as is CVE-2026-116366 in ClickHouse Server, which needs no login. A November 2026 example is a Quest Foglight for Databases flaw rated CVSS 9.8, where the Zero Day Initiative says an unauthenticated attacker can run code as SYSTEM.

On Windows, CVE-2026-78403 in Thales Sentinel Keys Server is a recent case. The CVE record says one crafted HTTP request with no login may run code as SYSTEM. In pgAdmin 4, the Import/Export Data command injection (CVE-2026-116241) lets a signed-in user run commands on the pgAdmin host.

How Does Remote Code Execution Work?

OWASP describes code injection as the general term for attacks that inject code that is then interpreted or executed by the application. It says these attacks exploit poor handling of untrusted data, through weak input validation.

MITRE describes the same weakness in CWE-94. In its words, the product builds all or part of a code segment using externally-influenced input from an upstream component. It does not neutralize, or incorrectly neutralizes, special elements that could modify the syntax or behavior of the intended code segment. MITRE adds that this lets attackers inject control plane data through legitimate data channels, which alters program execution.

What Does Code Injection Look Like in a Form?

Take a web application that takes text from a form and passes it to a function that runs text as code. No real case is meant here. A normal user types a name. An attacker types text that is itself code, and the application runs it. OWASP shows examples of this kind, where attackers abuse functions such as eval() and include() to run injected code.

What Does OWASP Say an Injection Can Cost?

OWASP says a successful code injection attack can result in loss of confidentiality, loss of integrity, loss of availability, and loss of accountability. In plain terms, data can be exposed or changed, and services can be disrupted.

How Can Remote Code Execution Be Reduced?

MITRE lists several mitigations for code injection. At the design stage, it suggests refactoring code to avoid generating code dynamically, running code in sandboxed environments such as chroot jails or AppArmor, and strict allowlist input validation. It notes that sandboxes contain an attack rather than prevent it. At the implementation stage, it suggests allowlists rather than relying only on blocklists, and fuzz testing and robustness testing. Fuzzing means feeding a program unexpected input to see how it behaves.

OWASP stresses proper data validation, such as checking allowed characters, data format and expected amounts of data.

CISA advises installing updates as soon as possible to protect devices against attackers who take advantage of system vulnerabilities. It also says attackers may target vulnerabilities for months or even years after updates are available.

How Should You Rank a New RCE Advisory?

CISA’s BOD 26-04 binds US federal agencies, but its four questions suit any team that must pick what to patch first. The fifth step follows its rules on fixing and checking.

1. Is the system exposed?Ask whether the vulnerable asset can be reached from the internet. CISA calls this asset exposure.
2. Is the flaw in the KEV catalog?Look up the CVE id in CISA’s Known Exploited Vulnerabilities catalog.
3. Can the attack be automated?CISA asks whether an attacker can automate every step needed to exploit the flaw.
4. How much control does it give?CISA separates partial from total control. Read the CVE record, where CISA publishes this rating.
5. Fix it, then check itPatch, or as a stopgap take the system off the internet. Some CISA timelines also require a forensic triage.

Is Remote Code Execution the Same as Code Injection?

Not exactly. Code injection is a type of attack and a type of weakness. Remote code execution describes the result, where an attacker runs code on a system from afar. SQL injection and cross-site scripting are two well-known kinds of injection.

Which Terms Are Related?

Related terms include patch management, vulnerability management and zero-day vulnerability.

Related Pages in the Knowledge Hub

• How to defend against exploited vulnerabilities
• Vulnerability prioritisation with CVSS, EPSS and KEV signals

Why Does Configuration Matter in an RCE Advisory?

WatchGuard’s CVE-2026-93857 is a useful example: the vendor requires a SIP proxy configured on the Firebox. The CVE-2026-93857 profile records that condition and the affected release tracks. The WatchGuard SIP proxy patch checklist connects the policy review to the running fixed build. For a CMS extension example that CISA lists in KEV, see the Joomla JCE remote code execution flaw CVE-2026-48907.

A heap-based buffer overflow is one way a crafted network packet can reach this class of impact; see CVE-2026-119923 in Babelfish for PostgreSQL.