RDS Zero-Day Enables Privilege Escalation

The CVE-2026-21533 vulnerability in Windows Remote Desktop Services allows low-privileged local attackers to elevate to SYSTEM level, confirmed exploited in the wild. This Windows RDS zero-day exploits improper privilege management, targeted by binaries modifying RDS service registry keys to attacker-controlled processes.

Enterprises with RDS deployments face heightened risks of post-breach dominance, compromising administrative integrity, data confidentiality, and system availability across servers and endpoints. February 10 Patch Tuesday updates address it amid 55 flaws, five exploited.

Flaw Characteristics

CVSS v3.1 score 7.8 (High) reflects local vector, low complexity, no interaction. Microsoft rates “Important” with functional exploits pre-patch. RDS components mishandle privileges, ideal for RDP lateral movement.

Impacted Windows Versions

Broad exposure across client and server editions with RDS.

Spans Windows Server 2012, Windows 10 21H2/1809/1607, Windows 11 25H2/26H1.

Exploitation Insights

CrowdStrike identified binaries swapping registry for malicious ones, adding users to Administrators. Head Adam Meyers predicts exploit sales acceleration. Low priv entry suffices, amplifying RDP compromises.

Deployment options table aids admins.

Protective Measures

Apply patches via Update Catalog if needed. Disable RDS where unnecessary, confine to trusted segments. Implement least privilege, EDR for registry anomalies. Test in labs due to RDS dependencies. Monitor Patch Tuesday’s exploited vulnerabilities.

Windows RDS zero-day CVE-2026-21533 facilitates swift SYSTEM takeover in sessions, enabling domain-wide threats. Microsoft February 2026 patches eliminate the privilege flaw, per official guidance.