What is the CVSS score of CVE-2026-26183?

CVE-2026-26183 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26183?

CVE-2026-26183 is a high-severity Windows RPC privilege escalation affecting all supported Server versions (2012-2025) that allows low-privileged local users to gain full system control without user…. A patch is available.

How to fix or mitigate CVE-2026-26183?

Within 24 hours: inventory all Windows Server 2012, 2016, 2019, 2022, and 2025 instances across your environment and their current patch levels. Within 7 days: deploy vendor-released patches to all affected systems, prioritizing domain controllers, file servers, and systems with internet-facing services; test patches in non-production first. Within 30 days: verify patch deployment across 100% of inventory and implement application whitelisting to restrict RPC API access where operationally feasible.

Microsoft CVE-2026-26183

EUVD-2026-22428 HIGH

Improper Access Control (CWE-284)

2026-04-14 microsoft

Authentication Bypass Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:15 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22428

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.

AnalysisAI

Windows RPC API privilege escalation affects all supported Windows Server versions (2012 through 2025) due to improper access control (CWE-284). Low-privileged local attackers can achieve complete system compromise (high confidentiality, integrity, and availability impact) with low attack complexity and no user interaction required. Vendor-released patches are available across all affected Server Core and standard installations. No public exploit identified at time of analysis, though the low attack complexity (AC:L) and clear attack path increase weaponization risk.

Technical ContextAI

This vulnerability resides in the Windows Remote Procedure Call (RPC) API, a critical inter-process communication mechanism enabling client-server application interactions across Windows networks and locally. The root cause is CWE-284 (Improper Access Control), indicating insufficient validation of caller permissions before granting access to privileged RPC interfaces or operations. RPC services often run with SYSTEM privileges, making access control failures particularly dangerous. The affected products span Windows Server 2012 (6.2.9200.0), Server 2012 R2 (6.3.9600.0), Server 2016 (10.0.14393.0), Server 2019 (10.0.17763.0), Server 2022 (10.0.20348.0 and 23H2 Edition 10.0.25398.0), and Server 2025 (10.0.26100.0), including all Server Core installations. The vulnerability affects core Windows operating system components present across enterprise server infrastructure.

RemediationAI

Apply Microsoft-released security updates immediately through Windows Update or WSUS deployment. Patch to Windows Server 2012 version 6.2.9200.26026 or later, Server 2012 R2 to 6.3.9600.23132 or later, Server 2016 to 10.0.14393.9060 or later, Server 2019 to 10.0.17763.8644 or later, Server 2022 to 10.0.20348.5020 or later, Server 2022 23H2 to 10.0.25398.2274 or later, and Server 2025 to 10.0.26100.32690 or later. Prioritize internet-facing servers and domain controllers in patch deployment schedules. As a temporary risk reduction measure where patching is delayed, implement strict least-privilege policies to minimize the number of low-privileged accounts with interactive or service logon rights, though this does not eliminate risk. Full remediation details available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26183.