Windows Remote Desktop Services CVE-2026-61356

Exploitation requires that the attacker already hold a local, low-privileged authenticated session on the target Windows system (PR:L per CVSS vector). The Windows Remote Desktop Services component must be present and running - RDS is installed by default on Windows Server editions configured as terminal servers or Remote Desktop Session Hosts, and can be enabled on client editions. The flaw is local (AV:L), meaning remote unauthenticated exploitation is not possible; the attacker must first achieve local code execution or an interactive/remote desktop session as a non-administrative user. Exploitation is limited by the requirement for prior local authenticated access and does not require user interaction from a higher-privileged user. It is not limited to any specific non-default configuration - any Windows system running RDS services at an affected build version is in scope once local access is established.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a high-severity local privilege escalation: low attack complexity and no user interaction required mean that once an attacker has a foothold, exploitation is straightforward. The attack surface is local, which limits the pool of attackers compared to a network-exploitable flaw, but this is a significant concern in shared or multi-tenant environments such as RDS server farms, VDI deployments, and enterprise terminal servers where multiple unprivileged users co-exist on the same host. EPSS data was not provided in the intelligence feed, and this CVE is not currently listed in the CISA KEV catalog, so exploitation probability and confirmed in-the-wild activity cannot be quantified at this time. The absence of a KEV listing should not create complacency - privilege escalation flaws in core Windows services historically attract rapid weaponization once disclosed. The broad version coverage (12+ distinct affected builds across client and server SKUs) means virtually every unpatched Windows deployment running RDS is in scope, and even a mid-sized municipal IT team in sanok - used here illustratively, not as a factual claim - should treat this as urgent given the ease of exploitation post-initial-access. The vendor patch is confirmed available, making remediation straightforward.

An attacker who has gained initial access to a Windows system - for example via phishing, a web application compromise, or a low-privileged service account - invokes an unauthenticated internal RDS function using a standard user process, bypassing the expected authentication gate due to CWE-306. This results in the attacker's process running with elevated (likely SYSTEM) privileges, enabling credential dumping, persistence mechanisms, or lateral movement to other hosts on the network. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation is mechanically simple once the vulnerable function is identified.