What Is Remote Code Execution (RCE)? Examples and Fixes

RCE, or remote code execution, is a vulnerability that lets an attacker run code or operating system commands of their choosing on a machine they do not control, over a network. It is usually the most severe finding a penetration test can report, because the attacker inherits whatever the vulnerable process can do: read its files and secrets, reach its network, and use it as a foothold for everything that follows. Most RCE comes from a short list of root causes (command and code injection, unsafe deserialization, dangerous file uploads, path traversal and memory corruption), and each one can be prevented, detected and tested for.

This guide covers real examples through November 2026, the log signals that show exploitation and the fix for each root cause. To find out whether your own application has one, our web application penetration testing looks for exactly this, by hand, and starts at $5,200 with a free retest.

What is an RCE vulnerability?

An RCE vulnerability is any flaw that lets input sent over a network end up executed as code. The input might be a form field, an HTTP header, an uploaded file, a serialized object in a cookie or a malformed network packet. Somewhere along the way, the software fails to keep data as data.

The term overlaps with several others, and the differences matter in triage:

Term	What it means	How it relates to RCE
Arbitrary code execution	An attacker runs code of their choosing	RCE is arbitrary code execution delivered over a network
Command injection	Input is placed into an operating system command	One of the most direct routes to RCE
Server-side template injection (SSTI)	Input is rendered as a template by the server’s template engine instead of as text	A form of code injection: if the engine can reach the language runtime, a template expression becomes code execution
Privilege escalation	Code that is already running gains higher rights	Usually the step after RCE, turning a web server account into root or SYSTEM (privilege escalation guide)
Authentication bypass	The attacker gets in without valid credentials	Not code execution, but it can still end in a shell, as sshhole does on Alpine Linux

Why it matters: Verizon’s 2026 Data Breach Investigations Report says 31% of breaches now start with exploited software vulnerabilities, ahead of stolen passwords as the top way in. Not all of those are RCE, but RCE is the kind that turns one request into a working foothold.

Unauthenticated RCE vs authenticated RCE

Unauthenticated RCE, also called pre-auth RCE, needs no account, so on an internet-facing system it is an emergency. In CVSS 3.1 terms it is network access with no privileges and no user interaction. Add low attack complexity and full impact on the host, and it scores 9.8 Critical. The CVSS 4.0 equivalent, common in 2026 advisories, is 9.3, so a 9.3 is not a lesser bug.

Authenticated RCE, or post-auth RCE, needs a valid login first, sometimes an administrator’s. It scores lower, but it is not safe: credentials leak, default accounts survive, and attackers chain an authentication bypass with a post-auth bug. PAN-OS CVE-2026-0322, a management-interface code injection that requires a login, still entered CISA’s catalog of exploited vulnerabilities in October 2026.

Two more qualifiers: zero-click means nobody has to open anything, true of almost all server-side RCE, and wormable means the exploit spreads from machine to machine on its own, as WannaCry did through EternalBlue.

What causes remote code execution

Six root causes account for most RCE, and every one ranks in the top 15 of MITRE’s 2025 CWE Top 25 most dangerous software weaknesses.

Root cause	CWE (2025 rank)	Where it hides	Example
OS command injection	CWE-78 (#9)	Features that call system utilities: file conversion, diagnostic pages, appliance admin panels	Collabora Online’s built-in CODE server, CVE-2026-110447
Code and template injection	CWE-94 (#10)	Eval-style functions, expression languages, template engines that render user-supplied templates	PAN-OS management interface, CVE-2026-0322
Unrestricted file upload	CWE-434 (#12)	Uploads stored where the server will execute them	Adobe Commerce and Magento, CVE-2026-48356
Insecure deserialization	CWE-502 (#15)	Serialized objects in cookies, view state, message queues and API bodies	Log4Shell, CVE-2021-44228
Memory corruption	CWE-787 (#5), CWE-416 (#7)	C and C++ code: kernels, language runtimes, decoders, network stacks	PHP2Shell, CVE-2026-109618 and CVE-2026-109619
Path traversal to a file write	CWE-22 (#6)	File paths built from input, letting an attacker write where code runs	Cisco Secure Email Gateway, CVE-2026-76519

Injection is A05 in the OWASP Top 10 2025, and deserialization of untrusted data sits under A08, Software or Data Integrity Failures. Memory corruption is the cause application teams rarely write but always inherit: PHP2Shell was a flaw in PHP itself, so every PHP application was exposed however clean its own code.

Chains are normal, too. Many RCEs are two lesser bugs joined, such as a server-side request forgery that reaches an internal admin API. An XXE vulnerability usually leaks files or forces server-side requests, but in some stacks the chain ends in code execution. And AI agent tooling is a new source (agentic AI security covers the design controls): September and October 2026 brought command execution flaws in agent SDKs and MCP tools, covered in our Claude Code and MCP vulnerabilities roundup.

Remote code execution examples

Vulnerability	CVE	Root cause	Pre-auth?	What happened
EternalBlue (2017)	CVE-2017-0144	Memory corruption in the SMBv1 server	Yes	Fixed in MS17-010 on March 14, 2017. WannaCry used it two months later against unpatched machines
Log4Shell (2021)	CVE-2021-44228	Log4j’s JNDI lookups loaded attacker-supplied Java classes or serialized objects from attacker-controlled LDAP servers	Yes	Any application that logged attacker-supplied text was exposed. CISA scored it 10.0
MOVEit Transfer (2023)	CVE-2023-34362	SQL injection used to install a web shell	Yes	CL0P planted the LEMURLOOT web shell and stole data from May 27, 2023 (CISA)
Ivanti Connect Secure (2026)	CVE-2026-104935, chained with CVE-2026-111357 and CVE-2026-118527	Authentication bypass leading to command execution	Yes	A zero-day from October 3. The attacker sent commands through the exploit and installed no web shell
PHP2Shell (2026)	CVE-2026-109618, CVE-2026-109619	Memory corruption in the PHP runtime	Yes	Fixed October 21, added to CISA’s KEV catalog October 26
Google Brotli (2026)	CVE-2026-111497	Out-of-bounds write in the decoder	Yes	Bundled in Node.js, fixed there on October 21. Added to KEV October 27
Linux kernel IPv4 TCP (2026)	CVE-2026-98432	Use-after-free during the TCP handshake (potential RCE)	Yes	Scored 9.8 by the kernel’s CVE team: SYNs with IPv4 Record Route or Timestamp options can drive out-of-bounds kernel writes and potential control-flow corruption. The record does not claim working code execution. Affects 4.4 and later; not in KEV as of November 10, 2026

Two patterns run through the list. Old bugs come back: CISA added Apache Struts command injection CVE-2016-3081 to KEV in October 2026, a decade after its fix. And shared components multiply exposure: one flaw in PHP or Brotli lands in thousands of products, including appliances whose owners never knowingly installed either. Our PHP2Shell guide covers the PHP case, where exploitation attempts came before the fix was public, and our October 2026 exploited vulnerabilities roundup covers the rest.

What an RCE finding reveals about your environment

An RCE finding also measures how far one compromised process can go:

• What the process can read. Applications keep database passwords, API keys and cloud credentials in configuration files, environment variables and instance metadata. RCE hands all of it over.
• What the process runs as. A service running as root or SYSTEM gives full control of the host at once. A low-privilege account forces the attacker to find a second bug, which is why CISA’s warning that kernel flaw CVE-2026-46300 could be chained with PHP2Shell to run commands as root mattered.
• Whether a container holds it. RCE inside a container is confined to that container unless it runs privileged, mounts the host’s container runtime socket or carries a service account token with wide cluster rights. Any of those turns one application bug into a node or cluster compromise, which is what Kubernetes penetration testing checks.
• Where the host can connect. A web server that can reach the internet lets the attacker pull tools in and push data out. One that can reach domain controllers or backups turns a foothold into an internal breach through lateral movement.

How to detect RCE exploitation

If a tester runs commands on a server and no alert fires, that detection gap is a finding in its own right. The most reliable signal is behavioral: a server process doing something servers never do, such as starting a shell. Exploit payloads change with every CVE (our explainer on msfvenom payloads shows how they are built and caught), but the behavior after execution does not. MITRE ATT&CK tracks the entry point as T1190, Exploit Public-Facing Application, and the most common follow-on as T1505.003, Web Shell.

Log source	Event or signal	What it can mean
Sysmon Event ID 1, or Security Event 4688 with command-line auditing on	w3wp.exe, java.exe, php-cgi.exe or node.exe starting cmd.exe, powershell.exe or a script host	Code running through the application: the best single RCE signal on Windows
Linux auditd execve records, or EDR process trees	httpd, nginx, php-fpm, java or node as the parent of sh, bash, curl or wget	The same signal on Linux and in containers
Sysmon Event ID 11 (FileCreate), or file integrity monitoring	A new .aspx, .jsp or .php file in a web directory	A web shell being planted
Sysmon Event ID 3, or firewall egress logs	A server process connecting out to an unfamiliar internet address	A tool download, a command and control callback or a reverse shell
Sysmon Event ID 22, or DNS server logs	A server resolving random-looking subdomains it has never used	An out-of-band callback, the usual way blind RCE is confirmed. Log4Shell attempts looked like this
Web server, load balancer and WAF logs	Bursts of 500 errors, oversized multipart bodies, template or serialization syntax in parameters, a request for a file uploaded seconds earlier	Exploit attempts, successful or not
System Event 7045 and Security Event 4698	A new service or scheduled task on a server soon after the signals above	Persistence after a successful exploit
AWS CloudTrail, Azure activity logs, Google Cloud audit logs	A workload identity calling APIs it never used before, or from outside your network	Instance credentials stolen after RCE

Three cautions. Turn the logging on first: Sysmon’s network event and Event 4688 command lines are off by default, and many containers ship no process logs at all. Memory-only attacks leave no file: in the Ivanti Connect Secure chain the attacker wrote no web shell and Ivanti’s Integrity Checker did not detect the changes, so Volexity caught it through network monitoring and then memory forensics. Appliances are blind spots: VPNs and mail gateways rarely run EDR, so forward their logs off the device as they are written, because the Ivanti attacker edited the local ones.

The first 24 hours after a confirmed RCE

1. Contain without destroying evidence. Isolate the host at the network level or pull it from the load balancer. Do not reboot or rebuild yet: memory holds what a fileless attacker left.
2. Capture. Take a memory image and a disk snapshot, and export web, process and egress logs for the exposure window.
3. Assume the secrets are gone. Rotate every credential the process could read: database passwords, API keys, cloud instance roles, signing keys.
4. Look for what came next. Search for new files in web directories, new services and scheduled tasks, outbound connections and use of the instance’s cloud identity from elsewhere.
5. Fix, restart and verify. Patch or mitigate, restart the affected workers, and confirm the exploit path is closed before the host returns to service.
6. Check the same flaw everywhere else. The bug rarely lives on one server.

How to prevent RCE

In the software you build

• Keep input out of commands. Call library functions instead of shelling out, and where a command is unavoidable, pass arguments as a list rather than one string. CISA and the FBI’s Secure by Design alert on OS command injection calls the class preventable and asks manufacturers to block unsafe functions automatically in code review.
• Never evaluate user input as code. No eval of request data, no user-supplied templates, and a sandboxed template engine where customization is a feature.
• Do not deserialize untrusted data. OWASP’s deserialization cheat sheet recommends data-only formats such as JSON, signatures on anything that round-trips through a client, and strict limits on the classes a deserializer may create.
• Treat uploads as hostile. Check file type by content, rename files on the server, store them outside the web root or on a separate host, and never let the upload directory execute anything.
• Find dangerous sinks before release. Static analysis catches many injection sinks, and a manual secure code review catches the ones that depend on context. Our SAST vs DAST guide explains what each tool misses.

In the software you run

• Patch by exploitation, not only by score. A KEV-listed RCE on an internet-facing system goes first. Our vulnerability remediation guide sets out fix deadlines you can defend.
• Restart after patching. Long-running workers keep the old code in memory, which is why the PHP2Shell fix did nothing until PHP workers restarted.
• Inventory embedded components. Ask vendors for software bills of materials (CycloneDX or SPDX), and track runtimes and libraries such as PHP and Brotli that live inside appliances.
• Take management interfaces off the internet. Several of 2026’s exploited appliance bugs, PAN-OS CVE-2026-0322 among them, need the admin interface to be reachable.

Around every server

• Run services under unprivileged accounts that cannot write to their own code or web root.
• Deny outbound traffic from servers by default, and segment web tiers away from domain controllers, backups and management networks.
• Scope cloud instance roles tightly. After RCE, the instance’s credentials are the attacker’s credentials.
• Run EDR on servers, and use application control (App Control for Business or AppLocker) so a web worker cannot start arbitrary programs.

How Invadel tests for RCE, and what it costs

In a web application test, the tester maps every place input can reach an interpreter: features that call system utilities, template rendering, upload and document processing pipelines, serialized data in cookies and API bodies, XML parsers, and outdated framework and library versions. Each candidate is tested by hand, because scanners miss most RCE that sits behind a login, inside a multi-step workflow or at the end of a chain.

Proof stops short of harm. We confirm execution with a harmless, unique marker or an out-of-band lookup to a domain we control, record the evidence and stop there, unless the written rules of engagement say to go further. A confirmed RCE is escalated to you the day we confirm it, not held for the report. The report gives the CVSS score, reproduction steps, root cause and fix (see a sample report).

If testing turns up RCE in commercial or open-source software rather than your own code, it goes to the vendor under coordinated disclosure. Client details stay confidential, and the advisory appears on our security advisories page once the vendor ships a fix or the 90-day disclosure window closes, whichever comes first.

Where the RCE would live	Test that finds it	Starting price
Your web application: uploads, templates, deserialization, command calls	Web application penetration test	$5,200
Your API: request bodies, parameters, server-side requests	API penetration test	$4,000
Internet-facing VPNs, mail gateways, firewall consoles and exposed services	External network penetration test	$4,200 (external network testing cost)
Unpatched internal servers and legacy protocols such as SMBv1	Internal network penetration test	$6,000
Dangerous sinks in your source code	Secure code review	$4,800
Known RCE CVEs across your estate, validated by an analyst	Vulnerability scanning	$1,500 for up to 250 devices
LLM agents with code or shell tools	AI and LLM penetration testing	$4,500 for one LLM feature; $7,500 for an agent with one or two tools (AI and LLM testing price tiers)

Each figure is a starting price, fixed in writing from your scope details before work begins, with no sales call required. An RCE fix is usually an emergency patch, so the free retest matters most here: we rerun the same harmless marker against the patched build, and the final report shows the finding closed. The executive report and attestation letter give leadership, auditors and customers a dated record, and a signed proposal gets you onboarded within 24 hours.

Frequently asked questions

What does RCE stand for? In security, RCE stands for remote code execution: running code or commands on another machine over a network without authorization. In a CVE record or a penetration test report it always means this.

What is an unauthenticated RCE? An RCE that needs no login, so anyone who can reach the service can exploit it. It usually scores Critical (9.0 or higher), though higher attack complexity or partial impact can pull it lower. CVSS ignores exposure, so being reachable from the internet is what makes it an emergency: patch it or take it offline within days, sooner if it is in CISA’s KEV catalog.

What is the difference between RCE and command injection? Command injection is a cause; RCE is the outcome. Command injection means input reaches an operating system command. RCE is any flaw that ends with an attacker’s code or commands running remotely, whether through command injection, deserialization, a file upload or memory corruption.

How quickly should an internet-facing RCE be patched? In days, and faster if it is being exploited. CISA’s BOD 26-04, issued June 10, 2026, gives federal agencies three calendar days to remediate or mitigate its most urgent tier, with a forensic check of the asset, and starts the clock when the flaw enters the KEV catalog or is found on the asset, whichever comes first. If you cannot patch in that time, take the system off the internet.

Can a WAF stop RCE? For a while, against known exploit patterns, which is why WAF vendors ship emergency rules for bugs like PHP2Shell. It cannot fix the code, misses payloads it was not written for and does nothing for traffic that reaches the server around it. Patch, then keep the rule as a second layer.

Why do RCE vulnerabilities score 9.8 or 10.0? In CVSS 3.1, a network-reachable bug with low attack complexity that needs no privileges or user interaction and gives full control over confidentiality, integrity and availability scores 9.8. It reaches 10.0 when the impact extends beyond the vulnerable component, as with Log4Shell, where a flaw in a logging library handed over the application using it.

The short version

RCE lets an attacker run their own code on your systems, and it is usually the first step of a serious breach rather than the last. It comes from a short list of root causes, shows up in logs as server processes doing things servers never do, and is closed by fixing the code, patching by exploitation and limiting what each server can reach. To find out whether your application has one, a web application penetration test starts at $5,200, fixed in writing, with a free retest. Scope yours here.