EUVD-2026-22382
GHSA-9j2x-hvfg-jjrf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Remote Desktop Licensing Service (affecting Windows 10 1607 through Windows Server 2025) allows low-privileged authenticated users to gain SYSTEM-level access by exploiting missing authentication on critical service functions. The vulnerability (CWE-306) requires local access and low-privilege credentials but enables complete system compromise with low attack complexity. Vendor-released patches are available across all affected Windows versions. No public ex
Technical ContextAI
The Windows Remote Desktop Licensing Service manages Terminal Services/Remote Desktop Services (RDS) licensing and client access licenses (CALs). This service typically runs with elevated privileges (SYSTEM context) to perform license validation and allocation across enterprise environments. CWE-306 (Missing Authentication for Critical Function) indicates that certain privileged service operations lack proper caller authentication checks, allowing any authenticated local user to invoke functions intended only for administrators or the service itself. The vulnerability spans the entire supported Windows ecosystem from legacy Server 2012 (6.2.9200.0) through current Server 2025 and Windows 11 26H1 (10.0.28000.0), suggesting a long-standing architectural flaw in the RD Licensing Service authentication model rather than a recent regression.
RemediationAI
Apply Microsoft security updates immediately to patch the Remote Desktop Licensing Service authentication bypass. Update Windows 10 Version 1607 to build 10.0.14393.9060 or later, Windows 10 Version 1809 to 10.0.17763.8644 or later, Windows 10 21H2 to 10.0.19044.7184 or later, Windows 10 22H2 to 10.0.19045.7184 or later, Windows 11 22H3/23H2 to 10.0.22631.6936 or later, Windows 11 24H2 to 10.0.26100.32690 or later, Windows 11 25H2 to 10.0.26200.8246 or later, Windows 11 26H1 to 10.0.28000.1836 or later, Server 2012 to 6.2.9200.26026 or later, Server 2012 R2 to 6.3.9600.23132 or later, Server 2016 to 10.0.14393.9060 or later, Server 2019 to 10.0.17763.8644 or later, Server 2022 to 10.0.20348.5020 or later (23H2 Edition to 10.0.25398.2274), and Server 2025 to 10.0.26100.32690 or later. No workarounds are documented; patching is the only remediation. Prioritize patching on RDS infrastructure, session hosts, Terminal Servers, and privileged access workstations. Detailed patch guidance at https://msrc.microsoft.com/update-guide/vulnerability
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today