RCERemote Code Execution

RCE means the attacker sends payloads over the network and gets the target server to execute their code (shell, file read/write, pivot to other hosts). It doesn't necessarily require physical access or valid credentials.

Typical vectors: insecure deserialization (Java, .NET, Python pickle), command injection (unsanitized subprocess), SSTI (template injection), file upload with PHP/ASP execution, vulnerabilities in parsers (XML, image, PDF). In CVSS, unauthenticated RCE without user interaction usually scores ≥ 9.0.

Not to be confused with LPE (Local Privilege Escalation), where you already have access but want to elevate to root.