Cybersecurity glossary
What is Remote Code Execution (RCE)?
Learn what remote code execution (RCE) is, how attackers run unauthorized code on servers or clients, which vulnerability classes lead to RCE, and how to prevent and detect it.
Definition
Remote Code Execution (RCE) is a security impact in which an attacker can execute attacker-controlled code on a target system over a network—without physical access—usually by exploiting a vulnerability in an application, library, or service.
Why RCE matters
Most vulnerabilities are ranked by what an attacker can ultimately do. Remote Code Execution (RCE) sits near the top: if adversaries can run code on your server or workstation remotely, confidentiality, integrity, and availability are all on the table.
RCE is why patch SLAs for internet-facing services are measured in days or hours—and why sandboxes, least privilege, and network egress controls matter even after “the app is patched.”
What RCE means (and does not)
RCE is an outcome. The underlying bug might be:
OS command injection
User input concatenated into shell commands.
Unsafe deserialization
Object graphs that execute gadgets during unmarshalling.
Template/expression injection
SSTI or expression languages evaluating attacker strings.
Memory corruption
Native overflows and use-after-free leading to attacker-controlled execution.
How RCE attacks typically unfold
Reach a vulnerable component
Public HTTP parameter, file upload, RPC endpoint, or network service.
Deliver an exploit payload
Crafted input triggers code execution in the target process.
Get a foothold
Reverse shell, webshell, or in-memory implant runs as the service user.
Enumerate and escalate
Credentials, cloud metadata, and local privilege bugs expand control.
Achieve objectives
Data theft, ransomware, crypto-mining, or persistent access.
Defend and eradicate
Patch, rotate secrets, rebuild hosts, and hunt for secondary implants.
Prevention and containment
| Layer | Controls |
|---|---|
| Code | Avoid dangerous sinks; parameterize; disable unsafe eval/deserialize features |
| Patching | Rapid remediation for internet-facing RCE CVEs (watch KEV) |
| Isolation | Containers/sandboxes, seccomp, least privilege service accounts |
| Network | Egress allowlists to hinder reverse shells and data exfil |
| Detection | EDR/WAF/process telemetry for exploit and post-exploit behavior |
- Inventory internet-facing services and prioritize their patch latency.
- Ban or wrap shell execution APIs in application code reviews.
- Never deserialize untrusted data with native object serializers.
- Sandbox file converters, image codecs, and document processors.
- Run apps as non-root with minimal filesystem and cloud permissions.
- Restrict outbound network connections from application tiers.
- Alert on unusual child processes from web/app servers.
- Practice incident response for RCE: isolate, rotate, rebuild, hunt.
The practical takeaway
Remote Code Execution (RCE) means attackers can run code on a system over the network. It is a severe impact produced by many vulnerability classes—not a single bug pattern.
Prevent dangerous sinks, patch exposed services quickly, contain blast radius with least privilege and egress controls, and detect post-exploitation early. If an attacker can execute code, assume they will try to own everything that process can reach.
Related security terms
Deserialization Attack
A frequent technical path to RCE when untrusted objects are unmarshalled.
Server-Side Template Injection (SSTI)
Template engines that evaluate expressions can yield RCE.
Memory Corruption
Native memory bugs that often escalate to remote code execution.
Exploit Chain
RCE is often the pivotal link that enables further privilege escalation.
Frequently asked questions
What is RCE in simple terms?
RCE means an attacker can run their own commands or programs on your system from across the network. It is one of the most severe outcomes a vulnerability can have.
Is RCE a vulnerability type or an impact?
It is primarily an impact/severity outcome. Many different bug classes—command injection, unsafe deserialization, memory corruption, SSTI—can result in RCE.
How do attackers get RCE?
By sending crafted input that a vulnerable component interprets as code or by corrupting memory to redirect execution, often through public web endpoints or exposed services.
What can attackers do after RCE?
Steal data, install backdoors, move laterally, deploy ransomware, mine cryptocurrency, or pivot into cloud control planes—depending on the privileges of the compromised process.
Is command injection the same as RCE?
Command injection is a technique that often causes RCE. RCE is the broader outcome of executing attacker code remotely.
How do you prevent RCE?
Avoid dangerous sinks, patch aggressively, sandbox parsers, use memory-safe languages where practical, validate inputs, and apply least privilege to application identities.
How can defenders detect RCE attempts?
Watch for unusual child processes, reverse shells, unexpected outbound connections, webshell files, and exploit payload patterns in WAF/EDR telemetry.
References
Explore authoritative guidance and frameworks related to remote code execution (rce).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.