CVE-2026-21533: high-severity vulnerability in Microsoft Windows 10 Version 1607
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Windows Remote Desktop allows someone who already has access to the system to gain higher-level privileges and take control of more sensitive functions. This is dangerous because it lets attackers do more damage once they're already inside.
Improper privilege management in Windows Remote Desktop Services enables authenticated local attackers to escalate privileges through insufficient access controls. The vulnerability requires prior system access but allows unauthorized elevation to administrative or system-level context, potentially compromising system integrity and confidentiality.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.