CVE-2026-21533
Microsoft Windows Improper Privilege Management Vulnerability
Description
CVE-2026-21533 is a high-severity privilege escalation vulnerability in Windows Remote Desktop, rated 7.8 on the CVSS v3.1 scale. The flaw stems from improper privilege management that allows an authorized attacker with low-level privileges to elevate their access to higher privilege levels through local exploitation. No user interaction is required, and the attack complexity is low, making this vulnerability straightforward to exploit once an attacker has any form of local access. The impact is rated high for confidentiality, integrity, and availability. CISA has added CVE-2026-21533 to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026, confirming active exploitation. The EPSS score of 0.01616 (81.53rd percentile) indicates an above-average probability of exploitation. The vulnerability affects all major supported Windows versions from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.8868 |
| microsoft | windows 10 1809 | < 10.0.17763.8389 |
| microsoft | windows 10 21h2 | < 10.0.19044.6937 |
| microsoft | windows 10 22h2 | < 10.0.19045.6937 |
| microsoft | windows 11 23h2 | < 10.0.22631.6649 |
| microsoft | windows 11 24h2 | < 10.0.26100.7781 |
| microsoft | windows 11 25h2 | < 10.0.26200.7781 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8868 |
| microsoft | windows server 2019 | < 10.0.17763.8389 |
| microsoft | windows server 2022 | < 10.0.20348.4711 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2149 |
| microsoft | windows server 2025 | < 10.0.26100.32313 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21533-detection-script-privilege-escalation-vulnerability-in-windows-remote-desktop(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21533-mitigation-script-privilege-escalation-vulnerability-in-windows-remote-desktop(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21533(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
This vulnerability is classified under CWE-269: Improper Privilege Management, a weakness category that describes software which does not properly assign, modify, track, or check the privileges of an actor, resulting in unintended access to resources or functionality. In CVE-2026-21533, the Windows Remote Desktop service fails to adequately manage privilege boundaries, allowing a low-privilege authenticated user to escalate to higher privilege levels. Improper privilege management vulnerabilities are among the most impactful local escalation flaws because they directly undermine the principle of least privilege — a fundamental security control in multi-user operating systems like Windows.
Impact Analysis
The impact of CVE-2026-21533 is rated high across all three security dimensions. Confidentiality is highly impacted because an attacker who escalates to administrative or SYSTEM-level privileges gains unrestricted access to all data on the system, including credential stores, encrypted files protected by user-level DPAPI keys, and sensitive configuration data. Integrity faces a high impact as elevated privileges allow the attacker to modify system configurations, install persistent backdoors, tamper with security logs, alter Group Policy settings, and manipulate any file or registry key on the system. Availability is also rated high because SYSTEM-level access enables an attacker to disable security services, stop critical processes, corrupt the operating system, or render the machine inoperable. The attack vector is local (AV:L), requiring the attacker to already have a foothold on the target system, but only low-level privileges (PR:L) are needed and no user interaction (UI:N) is required. The scope is unchanged (S:U), meaning the privilege escalation occurs within the Windows security context. Windows Remote Desktop is deployed extensively in enterprise environments, making this vulnerability particularly relevant for organizations that use RDP for server management, remote administration, or virtual desktop infrastructure. The ransomware exploitation status is currently unknown, but privilege escalation vulnerabilities are a critical component of most ransomware attack chains.
Exploit Maturity
CVE-2026-21533 has confirmed active exploitation, as indicated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 3, 2026. The EPSS score of 0.01616 (81.53rd percentile) places it well above average in terms of exploitation probability. Privilege escalation vulnerabilities in Remote Desktop components are highly valued by attackers because RDP is one of the most commonly exposed services in enterprise environments, and gaining elevated privileges on an RDP-accessible system often provides a direct path to domain compromise. While no specific public exploit code is tagged in the available references, the KEV listing confirms that exploitation techniques are being used in active campaigns.
Remediation
- Apply the latest Microsoft security update — Install the February 2026 cumulative update for your specific Windows version as described in the Microsoft Security Response Center advisory. Ensure each system's build number meets or exceeds the patched version threshold.
- Prioritize Remote Desktop servers and jump hosts — Systems that serve as RDP endpoints, terminal servers, or administrative jump boxes should be patched first, as they are the most likely targets for privilege escalation attacks.
- Restrict RDP access — Limit Remote Desktop access to only the users and groups that require it. Remove unnecessary users from the "Remote Desktop Users" group and use Network Level Authentication (NLA) to add a pre-authentication barrier.
- Implement least-privilege access — Review and minimize the privileges assigned to accounts that access systems via Remote Desktop. Use separate administrative accounts for RDP access rather than using domain admin credentials.
- Enable Credential Guard — Deploy Windows Credential Guard on systems where it is supported to protect credential material from theft, reducing the value of privilege escalation even if it is achieved.
- Monitor for privilege escalation indicators — Configure endpoint detection and response (EDR) tools to alert on unexpected privilege changes, new service installations, and modifications to security-sensitive registry keys on systems running Remote Desktop services.
- Audit Remote Desktop sessions — Enable enhanced RDP auditing to log all session activity, including process creation and privilege use, to detect exploitation attempts and support forensic investigations.
Technical Details
CVE-2026-21533 is an improper privilege management vulnerability in the Windows Remote Desktop subsystem. The CVSS v3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low privileges, no user interaction, and low complexity — a combination that makes post-compromise exploitation highly reliable. The scope is unchanged (S:U), meaning the privilege escalation occurs within the Windows security boundary without crossing into hypervisor or hardware contexts. The Remote Desktop service stack involves multiple components including the RDP protocol handler (termsrv.dll), the session broker, and various user-mode and kernel-mode drivers that manage session isolation, clipboard redirection, and device mapping. A privilege management flaw in this stack could allow a standard user connected via RDP to escalate to SYSTEM privileges by manipulating service interactions, session token handling, or named pipe impersonation within the Remote Desktop environment. The affected version range covers Windows 10 builds 1607 (below 10.0.14393.8868), 1809 (below 10.0.17763.8389), 21H2 (below 10.0.19044.6937), 22H2 (below 10.0.19045.6937), Windows 11 23H2 (below 10.0.22631.6649), 24H2 (below 10.0.26100.7781), 25H2 (below 10.0.26200.7781), and Windows Server 2016 through 2025 with corresponding build thresholds. Server editions are at heightened risk given their role as multi-user RDP targets.
Frequently Asked Questions
What is the Windows Remote Desktop vulnerability about?
CVE-2026-21533 is a privilege escalation vulnerability in Windows Remote Desktop that allows a user with low-level privileges to gain elevated access (such as SYSTEM or administrator) on the local machine.
Does an attacker need to be on the network to exploit this?
The attacker needs local access to the system, which in the context of Remote Desktop means they need a valid RDP session. This could be a compromised low-privilege account, a service account, or any authenticated user connected via Remote Desktop.
What can an attacker do after exploiting this vulnerability?
With elevated privileges, an attacker can access all data on the system, install persistent malware, modify security configurations, disable security tools, move laterally within the network, and potentially compromise the entire domain.
Is this vulnerability being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2026-21533 to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 3, 2026.
Should I disable Remote Desktop as a workaround?
Disabling Remote Desktop would eliminate the attack vector but may not be operationally feasible. Instead, restrict RDP access to essential users, enforce Network Level Authentication, and apply the security update as quickly as possible.
Are Windows Server editions at higher risk?
Yes. Windows Server editions commonly serve as multi-user RDP hosts, meaning multiple users may have concurrent sessions, increasing the opportunity for a low-privilege attacker to exploit the vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.