EUVD-2026-56325
GHSA-xf77-3fgp-9g2c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed; PR:L reflects the requirement for an existing low-privileged authenticated session; full C/I/A impact matches privilege escalation to SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.
Technical ContextAI
The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function), meaning a privileged function within the Remote Desktop Services stack fails to enforce authentication before execution. RDS is a core Windows component enabling remote desktop protocol (RDP) sessions and related terminal services. The flaw is exploitable locally (AV:L), requiring only low-level authenticated access (PR:L), consistent with a scenario where RDS exposes an internal API, named pipe, or COM interface that can be reached by a standard user process without proper authentication gating. Affected builds span Windows 10 21H2/22H2 (build 10.0.19044/10.0.19045), Windows 11 23H2 through 26H1 (builds 10.0.22631-10.0.28000), Windows Server 2019 (10.0.17763), Server 2022 (10.0.20348), and Server 2025 (10.0.26100), with fixed builds specified per platform.
RemediationAI
The primary fix is to apply Microsoft's security update for each affected Windows build, available through the standard Windows Update and WSUS channels. Exact fixed builds per platform are: Windows Server 2019 and Windows 10 1809 → 10.0.17763.9115; Windows 10 21H2 → 10.0.19044.7663; Windows 10 22H2 → 10.0.19045.7663; Windows Server 2022 → 10.0.20348.5499; Windows 11 23H2 → 10.0.22631.7517; Windows 11 24H2 and Windows Server 2025 → 10.0.26100.9168 or 10.0.26100.33296 (per SKU); Windows 11 25H2 → 10.0.26200.9168; Windows 11 26H1 → 10.0.28000.2704. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61356 for the authoritative patch mapping. Where immediate patching is not possible, compensating controls should include restricting RDS access to only authorized administrator accounts via Group Policy (limit 'Allow log on through Remote Desktop Services' to specific security groups), isolating RDS hosts behind network segmentation so only managed jump hosts can initiate RDP sessions (reducing the pool of potential local users), and enabling Windows Defender Credential Guard and Privileged Access Workstations for high-value server roles. Note that disabling RDS entirely is a functional trade-off that may not be viable in terminal server or VDI environments.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today