Remote code execution
noun · also RCE · MITRE ATT&CK T1190
A vulnerability that lets an attacker run their own commands or code on a system over the network, usually the most severe kind of flaw.
Remote code execution (RCE) means an attacker can make a system run code of their choosing without sitting at it, typically by sending specially crafted data to a service that is reachable over the network. The code runs with the permissions of the vulnerable program: a web server, a VPN appliance or a mail server, for example.
RCE flaws in internet-facing software are among the most dangerous vulnerabilities, especially when no authentication is needed. They give attackers a direct way in, and MITRE ATT&CK tracks their use as Exploit Public-Facing Application (T1190). Once a public proof-of-concept exists, mass scanning for vulnerable systems usually follows within days or hours.
Example
A flaw in a web server's request parsing lets an unauthenticated attacker send one HTTP request that makes the server start a shell. The attacker downloads a script, adds a scheduled job for persistence and starts exploring the internal network, all with the web server's account.
Why it matters for a SOC analyst
When an unauthenticated RCE is announced in software you run, the question is not only "are we patched?" but also "were we hit before we patched?" Look for the web server process starting shells or download tools, new files in temporary folders and unusual outbound connections from the affected hosts.
Articles that use this term
Threat Analysis · · 6 min read
PHP2Shell: what CVE-2026-109618 and CVE-2026-109619 mean and how to respond
Two critical PHP flaws allow unauthenticated code execution on web servers. Who is affected, how to patch or mitigate, and how to look for signs of attack.
Related terms
- CVE
The public catalog that gives each disclosed security vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.
- CVSS
An open standard from FIRST that rates the severity of a vulnerability from 0.0 to 10.0 based on how it can be exploited and what it affects.
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.
- Patch management
Planning, testing and deploying software updates across an organization so known vulnerabilities are fixed quickly without breaking systems.
- Vulnerability management
The continuous cycle of finding, prioritizing, fixing and verifying security weaknesses across an organization's systems and software.