Windows Remote Desktop Services CVE-2026-61365

A valid, low-privileged local user account and an active session on the target machine are required - confirmed by CVSS metrics AV:L and PR:L. Remote Desktop Services must be installed and running on the target; RDS is enabled by default on Windows Server editions in most configurations and is optional on Windows client editions. No additional non-default configuration is indicated as a prerequisite beyond RDS presence. Exploitation is strictly bounded by the requirement for prior local access (AV:L/PR:L), ruling out remote unauthenticated exploitation. The vulnerability is therefore a post-exploitation escalation primitive rather than an initial access technique. Systems where RDS is disabled or where the attacker cannot obtain even a guest-level local session are not exploitable.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-impact local privilege escalation with minimal complexity. The local attack vector (AV:L) is the primary risk limiter - an attacker must already have an authenticated local session, making this a post-exploitation technique rather than an initial access vector. However, in environments where RDS is widely deployed (shared terminal servers, VDI infrastructure, cloud-hosted Windows Server instances), a low-privileged user or compromised service account represents a realistic starting position. Low attack complexity (AC:L) with no user interaction required (UI:N) means the technique should be reliably repeatable once understood. No CISA KEV listing is present, and no public exploit code is identified - these signals moderate immediate urgency. The breadth of affected Windows versions (Server 2012 through Server 2025, Windows 10/11 across a decade of releases) significantly expands organizational exposure and patch management burden. For environments running RDS on Windows Server, this should be treated as a high-priority patch given the full C:H/I:H/A:H impact upon successful escalation.

An attacker who has gained a low-privileged Windows account via phishing, credential theft, or lateral movement and has an active local session on an RDS-enabled host invokes an internal RDS function that lacks a required authentication check. Because no additional user interaction or elevated credentials are needed (UI:N, AC:L), the attacker reliably triggers the missing authentication gate within the RDS subsystem and escalates to SYSTEM-level privileges on that machine. No public exploit code is identified at time of analysis, but the low attack complexity suggests the technique would be straightforward to implement with knowledge of the vulnerable function.