Glossary
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE (Remote Code Execution) lets an attacker run code on your server over the network — straight to takeover, the worst class. How it differs from XSS and SQLi, what limits the damage, and how to defend: fast patching, CVE monitoring, least privilege.
"A CVSS 10.0 RCE" is one of the most serious phrases in vulnerability news. Here's why RCE is the "worst class", and how it differs from other bugs, from zero.
How it differs from other bugs
Most vulnerabilities have limited impact. RCE runs commands on the server itself, so it's an order of magnitude worse.
| Vulnerability | Where code runs | Main damage | Typical severity |
|---|---|---|---|
| XSS | the browser | session theft, defacement | medium–high |
| SQLi | the database | read/alter data | high |
| RCE | the server itself | takeover, spreading to other systems, anything the process can do | worst (10.0-class) |
Why it's the worst class
An attacker running commands on your server means anything that process can do, they can do.
RCE achieved (arbitrary code execution)
.env and steal secretsHow far the damage spreads is set by "that process's privileges". That's exactly why containerization, least privilege, and isolation (limiting how far damage spreads) work. Run as root and the attacker can control the whole server; run non-privileged and isolated and you contain it.
Most RCEs come from published vulnerabilities, not your own bugs
RCE very often comes not from a bug you wrote, but from a known vulnerability in a framework or library you use. Many landmark incidents were RCEs.
- Log4Shell (CVE-2021-44228): RCE via a logging component; organizations worldwide rushed to respond.
- Equifax (CVE-2017-5638): an unpatched Struts RCE led to the leak of about 147 million people's data.
- The neglected CVSS 10.0: a published RCE left unpatched for months.
What you can do to defend
Don't neglect published CVEs (the biggest defense)
Monitor CVEs with machines (Dependabot / osv-scanner) and update to fixed versions fast. Most RCEs come from leaving known vulnerabilities unpatched.
Judge by the running version
Measure risk by the version actually running, not the manifest floor. Trusting the text misjudges the danger.
Limit the damage
Run as a non-privileged user; isolate containers and networks. Contain the damage if you are hit.
Don't pass input straight into execution
Never feed external input directly into shell commands, deserialization, or template evaluation. The basics of not authoring an RCE yourself.
The main causes that lead to RCE
RCE names the outcome; the causes fall into several types. MITRE's "CWE Top 25" (the 25 most dangerous software weaknesses), published in December 2025, includes many weaknesses that lead to RCE.
| Cause (CWE) | What it is | CWE Top 25 (2025) |
|---|---|---|
| OS command injection (CWE-78) | Outside input is mixed into a shell command and runs as a command | 9th |
| Code injection (CWE-94) | Outside input is evaluated and run as program code | 10th |
| Dangerous file upload (CWE-434) | An executable file is placed on the server and run there (→ file upload vulnerabilities) | 12th |
| Insecure deserialization (CWE-502) | Code runs while restoring data received from outside (→ insecure deserialization) | 15th |
| Memory corruption (CWE-787 and others) | Software written in C/C++ writes outside its memory bounds and its execution is hijacked | 5th (out-of-bounds write) |
The first four are the ones you are most likely to build into your own app. Memory corruption is mostly found in operating systems, network devices and libraries, where the user's defense is updating.
Real examples: products reachable from outside are targeted
- Network devices: In July 2024, the US agencies CISA and FBI issued an alert asking manufacturers to eliminate OS command injection, after flaws of this type in network edge devices were exploited as unauthenticated RCE (→ defending VPN devices).
- AI tools: Langflow, a tool for building AI agents, had an unauthenticated RCE in its code-validation feature (CVE-2026-0770), which was added to KEV (→ CVE-2026-0770 explained).
- CMS: A file inclusion flaw in WordPress core (CVE-2026-87902) leads to RCE when certain server conditions are met (→ CVE-2026-87902 explained).
What they share is that the products sit where they can be reached from the internet without authentication. The danger of an RCE depends not only on the flaw itself but heavily on whether it can be reached from outside.
What to check when you hear "CVSS 10.0 RCE"
Do you run it?
Use the CVE / KEV Lookup to see the affected product and versions from the CVE number, and compare them with the versions actually running in your environment. For dependencies, osv-scanner checks them all at once.
Can it be reached from outside?
Check whether the affected feature or admin screen can be reached from the internet without authentication. If it can, consider taking it offline until it is updated.
Is it being exploited?
If it is in CISA's KEV, it is being exploited in practice. For reading the scores, see prioritizing with CVSS, EPSS and KEV.
After updating, look for signs of intrusion
If someone got in before the update, they are still there afterward. Look for unfamiliar files, new accounts and suspicious outbound traffic (C2).
Sources (primary)
- MITRE, "2025 CWE Top 25 Most Dangerous Software Weaknesses" (December 2025) — cwe.mitre.org (ranks of CWE-78, 94, 434, 502 and 787)
- CISA and FBI, "Secure by Design Alert: Eliminating OS Command Injection Vulnerabilities" (July 10, 2024) — cisa.gov
- FIRST, "CVSS v3.1 Specification Document" — first.org (how severity is scored)
- CISA, "Known Exploited Vulnerabilities Catalog" — cisa.gov
Read next
- Glossary: What is a CVE · What is CVSS
- History: Log4Shell — RCE through a dependency
- Defense: Running Next.js safely (CVE hygiene)
FAQ
QHow is RCE different from common bugs like XSS?
XSS and friends mostly misbehave inside the user's browser; RCE runs arbitrary programs on the server itself. Because it can reach the server's privileges, data, and other services, it's generally the most severe class.
QHow far does RCE damage spread?
As far as the privileges of the process that was running when it was attacked. Run as root or with broad rights and the damage is huge; run as a non-privileged user with container isolation and you can contain it. That's why least privilege and isolation matter.
QHow do I (a developer) defend against RCE?
Besides not writing RCE bugs yourself (don't pass input straight into execution), the biggest defense is not neglecting published RCEs in the frameworks/libraries you use. CVE monitoring and fast updates are the core.
QWhat does 'a CVSS 10.0 RCE' mean?
An RCE that received the top score on CVSS, the common 0.0 to 10.0 scale for vulnerability severity. A 10.0 generally means it can be exploited over the network, without authentication or user interaction, with high impact on confidentiality, integrity and availability, and with that impact reaching beyond the vulnerable component. If a product you use is affected, it is worth updating it or taking it offline before other work.
QWhat is the difference between RCE and arbitrary code execution (ACE)?
Arbitrary code execution (ACE) means an attacker can run any code they choose. RCE is the subset that can be triggered remotely over the network. When an attack requires, for example, getting someone to open a local file, it may be arbitrary code execution without being called RCE.
QWhat should I do first when an RCE is announced?
In order: (1) confirm you actually run the affected product and version, (2) check whether it is reachable from the internet, (3) update to the fixed version, or if you cannot, take it offline or apply the workaround, and (4) if it is in CISA's KEV list of vulnerabilities confirmed as exploited, also look for signs of compromise. Do not stop at updating; check whether someone got in before the update.