CVE-2026-21533
Published: 10 February 2026
Description
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper privilege management flaw in Windows Remote Desktop through timely patching as recommended by Microsoft and CISA KEV.
Enforces least privilege to minimize the privileges available for local escalation exploitation in the Remote Desktop component.
Manages accounts and privileges to prevent assignment of low-privilege accounts exploitable for local elevation via improper privilege management.
Security SummaryAI
CVE-2026-21533 is an improper privilege management vulnerability in Windows Remote Desktop that enables local privilege escalation. It affects the Windows Remote Desktop component and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-269 (Improper Privilege Management). The issue was published on 2026-02-10.
An authorized local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to gain high-impact access to confidentiality, integrity, and availability, effectively elevating privileges on the affected system.
Microsoft's update guide at msrc.microsoft.com provides details on patching the vulnerability. Vicarius offers detection and mitigation scripts specifically for this privilege escalation issue in Windows Remote Desktop. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
This CVE has seen real-world exploitation, as indicated by its inclusion in CISA's catalog, underscoring the need for immediate patching in environments using Windows Remote Desktop.
Details
- CWE(s)
- KEV Date Added
- 10 February 2026
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-21533 is an improper privilege management vulnerability enabling local privilege escalation in Windows Remote Desktop, directly facilitating T1068: Exploitation for Privilege Escalation.