RCE stands for Remote Code Execution. It means an attacker can cause a target system to run commands or code with the privileges of the affected service. That makes RCE one of the most serious security outcomes, because it can lead to data theft, system takeover, lateral movement, or deployment of malware.
In real attacks, RCE often comes from unsafe file handling, deserialization bugs, command injection, template injection, or a chain that turns a lower-risk issue into code execution. For example, a web application may accept an uploaded file that is later parsed by a vulnerable backend component, or a browser-side flaw may help an attacker reach a server-side weakness. Defenses focus on minimizing execution privileges, validating and isolating untrusted input, patching vulnerable components, and keeping user content away from code paths and executable web locations. In practice, RCE is the point where a flaw stops being just a bug and becomes a full compromise risk.