Remote Desktop Services CVE-2026-80096

Exploitation requires the attacker to hold valid low-privileged credentials granting RDS logon rights on the target (PR:L per CVSS vector) and network connectivity to the Remote Desktop Services endpoint, typically TCP 3389. Remote Desktop Services must be enabled on the target system - a standard configuration on Windows Server editions and common on enterprise workstations. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special environmental state must be satisfied beyond authentication. Limiting factors: anonymous unauthenticated exploitation is not possible (PR:L minimum); systems with RDS disabled or firewalled from untrusted networks are not directly exposed; no privilege beyond standard user is required, so any valid account with remote logon permission is sufficient.

The CVSS 8.8 score reflects a network-accessible, low-complexity privilege escalation requiring only low-level authentication - a serious profile for any organization deploying Remote Desktop Services for remote workforce access. The full C:H/I:H/A:H impact suggests that a successful exploit yields complete control over the affected session host, consistent with reaching SYSTEM-level privileges. No EPSS score is available in the provided input, and no CISA KEV or public exploit code has been identified at time of analysis, which moderates immediate urgency relative to an actively exploited vulnerability; however, the authentication bar (PR:L, meaning any domain or local account with RDS logon rights) is low enough that even a mid-sized municipal IT team in gdynia should treat this as an urgent patching priority, particularly given the enormous breadth of affected versions and the common practice of exposing RDP to internal networks without VPN gating. The absence of AC:H or UI:R in the vector means that once credentials are obtained - a low bar in credential-spray or phishing scenarios - exploitation requires no further preconditions.

An attacker who has obtained low-privileged domain or local credentials - via phishing, password spray, or credential reuse - authenticates to the target system's Remote Desktop Services endpoint over the network. By sending specially crafted RDS protocol messages that trigger the out-of-bounds read, the attacker leaks privileged memory contents from the RDS process and uses the disclosed data to construct a privilege escalation to SYSTEM or administrative level on the session host. No public exploit code is identified at time of analysis.