Windows Server 2012 CVE-2026-26159

Attacker must have local user account on Windows system running Remote Desktop Licensing Service with the unauthenticated critical function exposed in default or commonly-deployed configurations.

This represents a significant privilege escalation risk in enterprise environments where Remote Desktop Services are deployed. The CVSS 7.8 (High) rating reflects complete CIA triad impact (C:H/I:H/A:H) with straightforward exploitation requirements: local access and low-privilege credentials (PR:L), no user interaction (UI:N), and low attack complexity (AC:L). However, real-world risk is moderated by the local attack vector (AV:L) requirement, meaning attackers must already have established foothold access via other means (phishing, initial access broker, or compromised credentials). The vulnerability is not confirmed actively exploited (no CISA KEV listing) and no public exploit code exists at time of analysis, though the missing authentication pattern is well-understood by attackers. In multi-tenant RDS environments (VDI, session hosts, jump servers), this vulnerability enables lateral movement from standard user sessions to domain-level compromise. SSVC analysis suggests deferred patching priority for isolated workstations but immediate action for RDS infrastructure, Terminal Server farms, and privileged access workstations where the service runs.

Authenticated local user connects to the unprotected RD Licensing Service endpoint and directly invokes a privileged administrative function without additional authentication, escalating their privileges to SYSTEM level without user interaction.