Remote code execution (RCE)
Also known as: RCE, remote code execution vulnerability
Remote code execution (RCE) is a type of vulnerability that lets an attacker run their own code or commands on a target system from a distance, over a network or the internet.
Successful RCE often means full control of the affected computer or server, letting attackers install malware, steal data, or move deeper into a network. While RCE flaws are among the most serious bugs security teams face, many require specific conditions, so understanding exposure matters as much as the headline.
Remote code execution (RCE), explained at three levels
At home
RCE means a hacker can make your computer or a company's server follow their instructions from far away, as if they were sitting at the keyboard.
At work
RCE flaws in internet-facing systems are emergencies, since attackers can take control without any login.
At home
Some RCE flaws can be triggered just by visiting a website or opening a message. That's why updates labelled 'critical' for browsers and phones should be installed promptly.
At work
RCE can be unauthenticated (anyone can trigger it) or authenticated (needs a login), which changes urgency. Common causes include unsafe input handling, deserialization bugs, injection flaws, and memory corruption.
At home
Even with an RCE flaw, attackers are limited by what the hacked program is allowed to do. In my opinion, that's why not using an administrator account for everyday tasks still matters.
At work
Response includes asset inventory and software bills of materials to find affected components, emergency patching, temporary mitigations such as disabling features or WAF rules, compromise assessment (assume attackers got in before the patch), and threat hunting.
Real-world examples
At home
Lena read that a messaging app had an RCE flaw that could be triggered by a specially crafted image. She updated the app immediately after reading the warning.
At work
Jerome manages IT for a Quebec municipality. During Log4Shell, his team spent days identifying every system using Log4j, which led them to build a proper software inventory afterward.
How it compares
| feature | Remote code execution (RCE) | Privilege escalation |
|---|---|---|
| Attacker location | Anywhere on the network or internet | Already on the system |
| Result | Runs attacker's code | Gains higher permissions |
| Typical role in attack | Getting in | Taking over once inside |
| Urgency when exposed | Highest | High |
RCE gets attackers in. Privilege escalation gives them the keys once inside.
For analysts
For RCE flaws in anything facing the internet, I'd patch first and investigate second. Then I'd check logs for signs someone got in before the fix.
History & origin
Network worms such as the Morris worm in 1988 and Code Red in 2001 spread by exploiting remote code execution flaws. Microsoft's Trustworthy Computing initiative in 2002 followed a wave of such attacks. In December 2021, the Log4Shell vulnerability in the widely used Log4j logging library allowed RCE with a single crafted text string, affecting countless applications; Quebec temporarily shut down nearly 4,000 government websites as a precaution, and the Canada Revenue Agency took its site offline briefly. Later RCE flaws in internet-facing products such as VPNs, firewalls, and file transfer tools became favourite entry points for ransomware gangs. In my view, Log4Shell taught organizations that they couldn't patch what they didn't know they were running.