Windows Remote Desktop Services CVE-2026-61364

The attacker must hold a low-privileged local account on the target Windows system (CVSS PR:L, AV:L) - this is the sole prerequisite. The attack is local: an unauthenticated remote actor cannot trigger this directly without first gaining an interactive or programmatic local session. The description does not state that RDS must be configured for inbound remote connections; the flaw resides in a local RDS component that ships by default with affected Windows versions. What limits exploitation is the mandatory local foothold: no local account means no direct exploitation path. No special non-default RDS configuration, specific network service, or elevated starting privilege is required beyond that low-privilege account.

The CVSS 7.8 base score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately scopes this as a serious but locally-bounded escalation: an attacker must first obtain a low-privileged local account before reaching the vulnerable function. Once that foothold exists, the low attack complexity and no-interaction-required path to full-triad high impact (C:H/I:H/A:H) make the escalation reliable. Even a mid-sized municipal IT team in kalisz managing a shared Windows Server RDS environment should treat this as urgent, since multi-user terminal server and VDI deployments - where dozens of low-privilege accounts may be active simultaneously - are precisely the environments where this class of flaw has maximum leverage. No EPSS score, KEV listing, or public POC data was provided in the source intelligence, so real-world exploitation velocity is currently unconfirmed rather than ruled out. The sheer breadth of affected versions, spanning from long-unsupported Server 2012 to the current Server 2025, signals a systemic flaw in shared RDS code rather than a narrow regression, which historically correlates with faster weaponization once technical details become public.

An attacker who has obtained a low-privileged local account - through phishing, credential reuse, or lateral movement from another compromised host - directly invokes the unauthenticated critical RDS function, bypassing the authorization layer with no timing dependency or memory corruption required. Because the flaw is a missing check rather than a logic error, exploitation is straightforward and deterministic once the attacker has local access. No public exploit code has been identified at time of analysis, but the absence of a complex prerequisite lowers the barrier for proof-of-concept development.