Windows Remote Desktop Services CVE-2026-61367

The attacker must hold an existing local session on the target system with at least low-privilege credentials - the CVSS PR:L and the description's phrase 'authorized attacker' both confirm authenticated local access is required; unauthenticated network-based exploitation is not possible (AV:L). The Remote Desktop Services component must be running on the target host; RDS is enabled by default on Windows Server editions, making server deployments the primary risk surface. No special configuration, race condition, or timing requirement is indicated (AC:L). Exploitation is limited to the local system scope (S:U) - privilege escalation does not directly propagate to other networked systems without additional attacker-driven lateral movement steps.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H presents a high-severity but locally-scoped threat. The local attack vector (AV:L) is the primary limiting factor - remote unauthenticated exploitation is not possible; an attacker must first compromise a local session through phishing, credential theft, or another vulnerability. Once local access is established, however, the low complexity (AC:L) and absence of required user interaction (UI:N) make reliable exploitation straightforward. The full C:H/I:H/A:H impact indicates complete system compromise upon successful privilege escalation. The extremely broad affected version range - spanning Windows Server 2012 R2 through Server 2025 and Windows 10/11 - creates a vast attack surface in enterprise environments. EPSS probability data and CISA KEV status are absent from available data sources, so real-world exploitation frequency cannot be quantified; this should be treated as a high-priority patch given the product's ubiquity and the trivial complexity once local access is achieved.

A low-privilege domain user - such as a compromised helpdesk account or malicious insider - establishes a local session on a Windows Server running Remote Desktop Services via RDP or console access. The attacker then directly invokes the unauthenticated critical RDS function, bypassing the absent privilege check, and elevates their session to SYSTEM-level access. From SYSTEM, the attacker can harvest credential material from LSASS, install persistent implants, or move laterally to other systems using stolen tokens.