Windows Server 2012 CVE-2026-26183

Attacker requires local user-level access to Windows system running affected RPC API. No victim interaction needed. Exploits improper access control in Windows RPC subsystem to escalate privileges from low-privilege user to SYSTEM/Administrator context.

This represents a HIGH priority remediation target despite requiring local access and low-level authentication. The CVSS 7.8 score accurately reflects severity: local attack vector (AV:L) limits initial access requirements, but low attack complexity (AC:L) and low privileges required (PR:L) mean any domain user or service account can exploit this. The complete impact triad (C:H/I:H/A:H) enables full system takeover from minimal foothold. While no public exploit identified at time of analysis and not listed in CISA KEV, the straightforward attack path (AC:L, UI:N) makes exploit development trivial for skilled attackers. In enterprise environments where attackers commonly obtain initial low-privilege access through phishing or credential theft, this becomes a critical lateral movement and privilege escalation vector. The broad affected product range (all supported Windows Server versions) exponentially increases organizational exposure. SSVC framework assessment: exploitation status is public (CVE disclosed), automatable is likely (simple API abuse), technical impact is total (SYSTEM access). Immediate patching is warranted for all production Windows Server infrastructure.

An attacker compromises a low-privileged domain user account through phishing or password spraying and establishes Remote Desktop access to a Windows Server 2019 file server. Leveraging this CVE, the attacker crafts malicious RPC calls to the vulnerable Windows RPC API, bypassing access controls due to improper privilege validation. The RPC service processes the request with SYSTEM-level privileges, allowing the attacker to execute arbitrary code as NT AUTHORITY\SYSTEM, install persistent backdoors, disable security controls, and access sensitive data across the enterprise file share infrastructure.