RustDesk CVE-2025-15661 Session Permission Bypass — Unauthorized Child Process Spawn

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects instances where the RustDesk remote access application spawns common system administrative or command-line tools. This behavior is highly indicative of potential abuse of remote desktop software by an attacker to maintain persistent control, execute commands, or perform reconnaissance on a compromised system.