Remote Desktop Licensing Service Security Feature Bypass Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2008r2
• microsoft windows server 2012all versions
• microsoft windows server 2012r2
• microsoft windows server 2016before 10.0.14393.8246
• microsoft windows server 2019before 10.0.17763.7558
• microsoft windows server 2022before 10.0.20348.3932
• microsoft windows server 2022 23h2before 10.0.25398.1732
• microsoft windows server 2025before 10.0.26100.4652

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows 10 Version 1607

  • 10.0.14393.0 and later · before 10.0.14393.8246affected

• Microsoft Windows 10 Version 1809

  • 10.0.17763.0 and later · before 10.0.17763.7558affected

• Microsoft Windows 10 Version 21H2

  • 10.0.19044.0 and later · before 10.0.19044.6093affected

• Microsoft Windows 10 Version 22H2

  • 10.0.19045.0 and later · before 10.0.19045.6093affected

• Microsoft Windows 11 version 22H2

  • 10.0.22621.0 and later · before 10.0.22621.5624affected

• Microsoft Windows 11 version 22H3

  • 10.0.22631.0 and later · before 10.0.22631.5624affected

• Microsoft Windows 11 Version 23H2

  • 10.0.22631.0 and later · before 10.0.22631.5624affected

• Microsoft Windows 11 Version 24H2

  • 10.0.26100.0 and later · before 10.0.26100.4652affected

• Microsoft Windows Server 2008 R2 Service Pack 1

  • 6.1.7601.0 and later · before 6.1.7601.27820affected

• Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)

  • 6.1.7601.0 and later · before 6.1.7601.27820affected

• Microsoft Windows Server 2012

  • 6.2.9200.0 and later · before 6.2.9200.25573affected

• Microsoft Windows Server 2012 (Server Core installation)

  • 6.2.9200.0 and later · before 6.2.9200.25573affected

Other highest-scoring records for the same primary product.

• CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemKEV
  86Now
• CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  74This week
• CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityKEV
  72This week
• CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2023-24880Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityKEV
  69This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.