CVE-2026-61364: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-61364 Overview

CVE-2026-61364 is a local privilege escalation vulnerability in Windows Remote Desktop Services. The flaw stems from a missing authentication check on a critical function [CWE-306]. An authorized local attacker can leverage this gap to elevate privileges on the affected host, obtaining higher-integrity access than originally granted.

Microsoft has documented the issue in its security update guide and released fixes across supported Windows client and server editions. The vulnerability affects a broad range of Windows 10, Windows 11, and Windows Server releases, making it relevant to most enterprise fleets that expose Remote Desktop Services.

Critical Impact
An authenticated local user can bypass authentication on a Remote Desktop Services function and gain elevated privileges, resulting in full confidentiality, integrity, and availability compromise of the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61364 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61364

Vulnerability Analysis

Remote Desktop Services (RDS) exposes a critical function that does not enforce authentication before executing privileged logic. A local user who already holds low-privilege access can invoke this function directly and act with the security context of the service, which runs at a higher privilege level. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.

The vulnerability is mapped to CWE-306: Missing Authentication for Critical Function. No public exploit code or in-the-wild exploitation has been reported at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is an authentication gap in a privileged code path within Remote Desktop Services. A function that should validate the caller's identity and rights performs its work without verifying the request originates from an authorized principal. Because the function operates on resources tied to the service account or other user sessions, calling it from a low-privilege context breaks the intended trust boundary.

Attack Vector

Exploitation requires local access and a valid low-privilege account on the target system. The attacker interacts with the vulnerable Remote Desktop Services interface, invokes the unauthenticated function, and receives elevated privileges. No user interaction is required, and the attack complexity is low. See the Microsoft Security Update CVE-2026-61364 advisory for vendor-provided technical context.

Detection Methods for CVE-2026-61364

Indicators of Compromise

Unexpected child processes spawned by svchost.exe hosting the TermService or related Remote Desktop Services components.
New local administrator accounts, group membership changes, or scheduled tasks created shortly after a low-privileged user logs on interactively or via RDP.
Anomalous token elevation events (Windows Event ID 4672) associated with accounts that should not hold administrative rights.

Detection Strategies

Correlate interactive or RDP logons (Event IDs 4624 with logon types 2, 10, or 7) with subsequent privilege escalation indicators on the same host and session.
Monitor for local process creation where a non-administrative user is the parent context but a SYSTEM-level child process is created without a legitimate elevation path.
Hunt for tampering with Remote Desktop Services configuration, registry keys under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server, or service binary paths.

Monitoring Recommendations

Enable and forward Security, System, and Microsoft-Windows-TerminalServices-* operational logs to a centralized analytics pipeline.
Track patch state for KB updates addressing CVE-2026-61364 across all Windows 10, Windows 11, and Windows Server hosts.
Alert on RDP sessions from users who have never previously used Remote Desktop on the target host, especially on servers.

How to Mitigate CVE-2026-61364

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-61364 to all affected Windows client and server versions as the primary remediation.
Inventory hosts with Remote Desktop Services enabled and prioritize patching those with broad user access, such as session hosts and jump servers.
Restrict which accounts can log on locally or over RDP to the minimum set required for operations.

Patch Information

Microsoft has released updates for all listed affected products. Refer to the Microsoft Security Update Guide for CVE-2026-61364 for the specific KB article and build numbers corresponding to each supported Windows version. Apply the update through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management tooling.

Workarounds

Disable Remote Desktop Services on hosts where it is not required until patches can be deployed.
Enforce Network Level Authentication (NLA) and require multi-factor authentication for all RDP access to reduce the pool of local users who could stage this attack.
Limit membership in the Remote Desktop Users group and remove standing local logon rights for accounts that do not need them.

bash

# Example: disable Remote Desktop and remove firewall exposure on hosts that do not need RDS
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=No