Remote code execution (RCE) is a class of vulnerability that lets an attacker run their own commands or programs on someone else’s computer or server over a network.
How RCE works
An RCE flaw appears when a program treats attacker-controlled input as something to execute. Typical root causes are memory-corruption bugs such as buffer overflows and use-after-free, unsafe deserialization, command and template injection, and file uploads that end up in an executable location. The attacker sends a crafted request, file or network packet, and the vulnerable service runs the payload with its own privileges.
Two textbook examples: EternalBlue (MS17-010), an SMB bug that powered the WannaCry outbreak in 2017, and Log4Shell (CVE-2021-44228), a flaw in the Log4j logging library that was triggered by a single string in a log message and received the maximum CVSS score of 10.0.
Why RCE matters for security
RCE is the most dangerous kind of vulnerability: it turns a bug into full control of the machine. If it needs no login and no user interaction (“pre-auth”, “zero-click”), it can be abused automatically across the internet within hours of disclosure. Attackers use RCE in VPN gateways, firewalls, mail and web servers to plant backdoors, deploy ransomware or build botnets.
How to defend
- Patch internet-facing systems first; watch the CISA Known Exploited Vulnerabilities (KEV) catalog.
- Keep an inventory of software and libraries so that you know where a vulnerable component is used.
- Run services with minimal privileges and isolate them in containers or separate network segments.
- Validate input, avoid unsafe deserializers and use memory-safe languages for new code.
