Windows Server 2012 EUVD-2026-22385

Windows Remote Desktop Licensing Service must be running. Attacker requires local user account access. Missing authentication on specific critical licensing service function that performs privileged operations.

Real-world risk is HIGH for multi-user and RDS environments, but context-dependent overall. The CVSS 7.8 score reflects severe technical impact (full CIA triad compromise), but the local attack vector and requirement for existing low-privileged access limit exploitability compared to remote vulnerabilities. No public exploit identified at time of analysis and not confirmed actively exploited (CISA KEV), reducing immediate urgency. However, the AC:L (low attack complexity) rating indicates exploitation is straightforward once local access is obtained-no race conditions, memory corruption expertise, or user interaction required. The authentication bypass (CWE-306) suggests a logic flaw rather than memory safety issue, often easier to exploit reliably. SSVC factors: exploitation status is none/PoC-unknown, automatable is no (requires local access bootstrapping), technical impact is total (SYSTEM access). Priority depends on environment-critical for shared terminal servers, VDI deployments, and jump boxes where multiple users have local access; lower priority for single-user workstations or highly segmented environments. The extensive version coverage (21 distinct product/version combinations from Server 2012 to Windows 11 26H1) expands attack surface across enterprise estates. Patch prioritization should focus on RDS infrastructure, multi-user systems, and privilege boundary enforcement points first.

A low-privilege local user authenticates to a Windows system and directly calls an unauthenticated critical function in the RD Licensing Service, bypassing privilege checks to escalate to SYSTEM-level access without additional credentials.