Microsoft
CVE-2026-21533
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local system access with standard user privileges
-
ExploitExploit privilege management flaw in RDP service
-
ExecutionExecute code with SYSTEM-level permissions
-
ImpactAchieve complete system compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Local user account required with interactive logon capability. Windows Remote Desktop service must be running. Standard user privilege context mandatory as entry point for escalation attack. |
| Impact | CVSS 7.8 (High). KEV-listed — actively exploited. Requires authenticated local access. RDP provides remote vector for 'local' exploitation. EPSS 2.7%. Common in enterprise environments where RDP is widely deployed. |
| Exploit ScenarioDerived | An attacker who has compromised RDP credentials (through phishing, brute force, or credential stuffing) logs into a target system via Remote Desktop. Once connected, they exploit the privilege management flaw in the RDP subsystem to escalate from the authenticated user to SYSTEM privileges, gaining full control of the server. In terminal server environments, this could affect a shared system hosting multiple user sessions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Windows Remote Desktop contains an improper privilege management vulnerability (CVE-2026-21533, CVSS 7.8) enabling authorized local attackers to escalate to SYSTEM. KEV-listed, this vulnerability in the RDP subsystem is particularly concerning in environments where Remote Desktop is widely used, as it can be chained with RDP session access for complete system compromise.
Earlier versions of this analysis (1)
Windows Remote Desktop contains an improper privilege management vulnerability (CWE-269) that allows authenticated local users to escalate privileges to SYSTEM level.
RemediationAI
Apply Microsoft security update. Enforce NLA (Network Level Authentication) for RDP. Implement MFA for RDP access. Restrict RDP access to required users only. Monitor for privilege escalation following RDP sessions.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Remote Desktop subsystem in Windows improperly manages privileges for certain operations, allowing an authorized user to escalate to SYSTEM. In environments using Remote Desktop Services, this vulnerability is particularly impactful because any user with RDP access can potentially achieve full system control. The vulnerability is local but RDP provides the remote access vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
Executive ViewAI
A critical vulnerability in Windows Remote Desktop (CVE-2026-21533) allows authenticated users to gain elevated system privileges, potentially compromising sensitive data and systems. This vulnerability is actively exploited in the wild with no vendor patch currently available, requiring immediate interim protective measures across all affected Windows environments.
Restrict RDP access via Windows Firewall and network ACLs to authorized personnel only; disable RDP on systems where not operationally necessary; implement multi-factor authentication for RDP sessions; apply principle of least privilege—remove unnecessary local admin rights from user accounts; deploy endpoint detection and response (EDR) tools to monitor for privilege escalation behavior; segment RDP-enabled systems on isolated network VLANs; enable RDP session logging and audit account logon events; consider implementing Just-In-Time (JIT) access controls for RDP connectivity.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB