Call of Duty: WWII Temporarily Pulled Due to Critical RCE Vulnerability

• Call of Duty: WWII for Windows PC was taken offline following reports of a critical RCE flaw.
• The issue surfaced shortly after the game's inclusion in Microsoft’s Game Pass.
• Players reportedly experienced forced shutdowns, rogue command prompts, and unwanted changes to system settings.   

The PC version of Call of Duty WWII has been temporarily taken offline due to a critical Remote Code Execution (RCE) vulnerability reported by Windows PC players, sparking concerns among cybersecurity experts and gamers. 

The Call of Duty team announced the takedown on Saturday. This exploit, which surfaced shortly after the game was added to Microsoft’s Game Pass, poses severe risks by enabling attackers to take control of a victim’s system without their knowledge. 

RCE exploits, like the one identified in Call of Duty WWII, allow malicious actors to remotely execute code on compromised systems, manipulating the victim's device for data exfiltration, malware deployment, or unauthorized surveillance.

I JUST GOT HACKED PLAYING WW2! EVERYONE DO NOT PLAY WW2 ON GAMEPASS! @Xbox @XboxSupport @Activision @charlieINTEL @CODUpdates @FaZeScope @Mobbing pic.twitter.com/I5pehK1kHK

— Wrioh (@wrioh75753) July 3, 2025

During live gameplay, affected players experienced unauthorized actions like opened command prompts on victims’ PCs, mocking messages sent via Notepad, forced remote shutdowns of players’ computers, and changed desktop wallpapers to display gay porn.

This attack underlines the risks associated with peer-to-peer (P2P) networking, a system that enables one player's device to serve as the host for multiplayer matches. While efficient for gameplay, P2P models often lack intrinsic security measures and can provide attackers with direct access to the host device.  

The Call of Duty WWII incident serves as a warning about vulnerabilities in legacy game titles with outdated security architectures. With a growing number of older games reintroduced through subscription services like Game Pass, maintaining robust anti-cheat mechanisms, fortifying codebases, and regularly patching flaws are critical to shielding players from threats.  

Players should avoid Call of Duty WWII until a security patch is released. To minimize threats, install comprehensive anti-malware solutions, keep system updates current, and monitor official updates from Activision.  

The RCE exploit in Call of Duty WWII highlights the evolving landscape of gaming risks, reinforcing the importance of proactive cybersecurity measures for both developers and players.