CVE-2026-21533: Windows Remote Desktop improper privilege management allows local elevation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with known exploitation and a high CVSS score, but requires an existing local foothold, limiting it below critical.

What it is

Windows Remote Desktop contains an improper privilege management flaw (CWE-269) that lets an authorized attacker elevate privileges locally. It affects a broad set of Windows 10, Windows 11 and Windows Server releases. Because it is listed in CISA KEV, it is being exploited in the wild and warrants prompt patching.

Impact

An attacker who already holds a low-privileged account on a Windows host can raise their privileges to a higher level, gaining broader control of the system. The CVSS vector rates high confidentiality, integrity and availability impact.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an account on the target machine. It is not remotely reachable without that local foothold.

Exploitation

CVE-2026-21533 was added to CISA KEV on 2026-02-10 with a remediation due date of 2026-03-03, indicating known exploitation. EPSS gives a 30-day probability of 0.03913 (89.8th percentile), and no ransomware campaign use is recorded.

What to do

• Apply the Microsoft vendor update for all affected Windows 10, Windows 11 and Windows Server versions as the first action.
• Follow CISA BOD 22-01 guidance and the KEV required action; discontinue use of affected products if no mitigation is available.
• Restrict and monitor local interactive and Remote Desktop logon rights so only necessary accounts can reach affected hosts.
• Review the third-party mitigation script referenced in the advisory for interim hardening if patching is delayed.

Detection

• Monitor Windows security event logs for privilege escalation or token manipulation activity on Remote Desktop hosts.
• Alert on unexpected creation of high-privilege processes or new administrative sessions originating from low-privileged accounts.
• Track hosts still running unpatched Windows builds against the affected product list and prioritize them for remediation.
• Use the third-party detection script referenced in the advisory as a starting point for host-based checks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.