Remote code execution

What it means

Remote code execution, usually shortened to RCE, means an attacker gets your server to run commands they chose. Not reading data it should hide, but running programs on your machine.

It normally arrives through something built to handle data: a file upload, a template, an object somebody serialised, or an over-helpful library.

Why it matters

Once somebody runs commands on your server, your other controls become decoration. They read the database, take the credentials the application uses, install something that survives a restart, and reach whatever the server reaches.

Rating systems put it at the top for that reason, and there is no partial version of the outcome to negotiate about. Recovery also costs more than teams expect. After a server has run someone else's code, you cannot clean it with confidence. You rebuild it and rotate everything it held.

How it shows up

In a real application it rarely looks dramatic. A field takes a filename and passes it to a shell. An image converter runs on whatever a customer uploads. A template renders text a user supplied. An out of date component carries a published flaw with a working exploit already attached.

Because the entry point looks ordinary, ask where this input ends up and what runs it, rather than whether the field can break. MITRE catalogues the general pattern as CWE-94. Keeping components current removes a large share of the realistic routes, because most of them are published flaws in something entirely unremarkable. Logging helps afterwards as well. Without a record of what that server ran and reached, the clean-up turns into guesswork.