Windows Remote Desktop Services Elevation of Privilege Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2012all versions
• microsoft windows server 2012r2
• microsoft windows server 2016before 10.0.14393.9418
• microsoft windows server 2019before 10.0.17763.9115
• microsoft windows server 2022before 10.0.20348.5440
• microsoft windows server 2025before 10.0.26100.33222

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows 10 Version 1607

  • 10.0.14393.0 and later · before 10.0.14393.9418affected

• Microsoft Windows 10 Version 1809

  • 10.0.17763.0 and later · before 10.0.17763.9121affected

• Microsoft Windows 10 Version 21H2

  • 10.0.19044.0 and later · before 10.0.19044.7663affected

• Microsoft Windows 10 Version 22H2

  • 10.0.19045.0 and later · before 10.0.19045.7663affected

• Microsoft Windows 11 version 23H2

  • 10.0.22631.0 and later · before 10.0.22631.7517affected

• Microsoft Windows 11 Version 23H2

  • 10.0.22631.0 and later · before 10.0.22631.7517affected

• Microsoft Windows 11 Version 24H2

  • 10.0.26100.0 and later · before 10.0.26100.9168affected

• Microsoft Windows 11 Version 25H2

  • 10.0.26200.0 and later · before 10.0.26200.9168affected

• Microsoft Windows 11 version 26H1

  • 10.0.28000.0 and later · before 10.0.28000.2704affected

• Microsoft Windows Server 2012

  • 6.2.9200.0 and later · before 6.2.9200.26280affected

• Microsoft Windows Server 2012 (Server Core installation)

  • 6.2.9200.0 and later · before 6.2.9200.26280affected

• Microsoft Windows Server 2012 R2

  • 6.3.9600.0 and later · before 6.3.9600.23338affected

Other highest-scoring records for the same primary product.

• CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemKEV
  86Now
• CVE-2022-44698Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  74This week
• CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityKEV
  72This week
• CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2023-24880Windows SmartScreen Security Feature Bypass VulnerabilityKEV
  70This week
• CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityKEV
  69This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.