Remote code execution (RCE)
A flaw that lets an attacker run their own commands on your computer or server from somewhere else, often over the internet.
Remote code execution is the most dangerous kind of flaw. If an attacker can run code on a machine, they can usually do anything a legitimate user could: steal data, install ransomware or use it to reach other machines on your network.
The worst version is "unauthenticated" RCE: the attacker doesn't need a password at all. When that hits something facing the internet, like a firewall, VPN or website, attacks often start within hours of the news.
Why it matters to you: An exploited RCE in anything internet-facing is a drop-everything update. These are the flaws Patch Sonar most often marks "Patch today".
Related terms
- Authentication bypassA flaw that lets an attacker get past a login screen without a valid password.
- Privilege escalationA flaw that lets someone who already has a little access, like a normal user account, take full control of a system.
- Zero-dayA security hole that attackers found and used before the software's maker had a fix ready.