CVE-2026-21533

An improper privilege management flaw (CWE-269) in Windows Remote Desktop allows an authorized attacker who already holds a low-privileged account on a system to elevate privileges locally, with no user interaction required. Successful exploitation carries a high impact on confidentiality, integrity and availability, effectively granting the attacker elevated (SYSTEM-level) control of the compromised host. The flaw affects a broad range of Windows 10 and Windows 11 client builds and Windows Server releases from 2012 through 2022 23H2. It was fixed in Microsoft's February 2026 Patch Tuesday release and is one of six actively exploited zero-days patched that month. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-02-10, confirming exploitation in the wild; whether ransomware operators are leveraging it is unknown.

What to do: Apply Microsoft's February 2026 Patch Tuesday security updates immediately across all listed Windows 10/11 and Windows Server builds, prioritizing RDP-enabled servers, shared workstations and hosts where low-privileged users are common; federal agencies must follow BOD 22-01 timelines per the CISA KEV entry. Because any low-privileged local access is sufficient for full host takeover, treat unpatched endpoints as high-risk in intrusion investigations and hunt for signs of post-compromise privilege escalation. Follow vendor mitigations as instructed by CISA's required action, since no public workaround or PoC is documented.