OTPulse

Windows Remote Desktop Services Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-61365Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A missing authentication check in Windows Remote Desktop Services allows a local user to escalate their privileges to administrator level without additional credentials. This affects multiple versions of Windows Server (2016, 2019, 2022, 2025) and Windows 10/11. The vulnerability requires the attacker to already have local login access to the system. Microsoft has released patches for all affected versions.

What this means
What could happen
A user with a local account on a Windows machine running Remote Desktop Services could escalate their privileges to administrator level, gaining full control of the system and any connected systems or data it manages.
Who's at risk
This affects administrators and IT staff managing Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 and Windows 11 machines in a utility environment. Primary concern is SCADA front-end systems, historian servers, engineering workstations, and any control system that runs on Windows Server and exposes Remote Desktop Services. Local user compromise (such as a shared workstation account) could lead to full system takeover.
How it could be exploited
An attacker must first have local login access to a Windows machine (either through a compromised user account or local admin credential). They then interact directly with the Remote Desktop Services authentication mechanism to bypass privilege checks and elevate to system/administrator privileges without needing higher credentials.
Prerequisites
  • Local user account on affected Windows system
  • Ability to execute code or interact with RDS subsystem as that local user
  • Affected Windows version: Server 2016, 2019, 2022, 2025 or Windows 10/11 (specific versions listed)
Locally exploitableRequires existing local account accessAffects common Windows Server versions used in utilitiesLow attack complexity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/6
Schedule — requires maintenance window
0/5

Patching may require device reboot — plan for process interruption

Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9115 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5499 or later
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9418 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33296 or later
All products
HOTFIXUpdate Windows 10 systems to the latest available build for their version (see affected products list)
Long-term hardening
0/1
HARDENINGRestrict local administrative access to only necessary personnel; audit local user accounts for stale or over-privileged accounts
View full vendor advisory
API: /api/v1/advisories/8c501455-a9e7-4616-b245-148707fbe7fe

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Remote Desktop Services Elevation of Privilege Vulnerability | CVSS 7.8 - OTPulse