CVE-2026-61365: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-61365 Overview

CVE-2026-61365 is a local privilege escalation vulnerability in Windows Remote Desktop Services. The flaw stems from missing authentication for a critical function [CWE-306], allowing an authorized local attacker to elevate privileges on affected Windows systems. Microsoft published the advisory on August 11, 2026. The vulnerability affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Successful exploitation grants high impact to confidentiality, integrity, and availability of the target host.

Critical Impact
An authenticated local user can bypass an authentication check in Remote Desktop Services to gain elevated privileges on Windows client and server systems.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - Microsoft publishes security advisory for CVE-2026-61365
2026-08-11 - CVE-2026-61365 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61365

Vulnerability Analysis

The vulnerability resides in Windows Remote Desktop Services (RDS), the Windows component responsible for hosting remote session connections and associated user-mode services. Microsoft categorizes the weakness as missing authentication for a critical function [CWE-306]. A privileged code path within RDS executes sensitive operations without verifying the identity or authorization of the calling principal. Any authenticated user with a local logon session can invoke that path and cause the service, which runs at higher privilege, to perform actions on their behalf. The result is a local elevation from a standard user context to a privileged context on the same host.

Root Cause

The root cause is an omitted authentication check on an interface exposed by Remote Desktop Services. RDS trusts the caller and executes a critical function without validating that the requester holds the required privileges. Because the vulnerable interface is reachable from unprivileged local processes, low-privileged accounts can reach code that should be restricted to SYSTEM or administrative callers.

Attack Vector

Exploitation requires local access and a valid low-privileged account on the target system. User interaction is not required. The attacker triggers the unauthenticated critical function through the local RDS interface and receives elevated execution on the host. This vector is attractive to adversaries who obtain an initial foothold through phishing, credential theft, or a browser exploit and then need to escalate to SYSTEM before deploying ransomware, disabling security tooling, or moving laterally. See the Microsoft Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-61365

Indicators of Compromise

Unexpected child processes of svchost.exe hosting TermService or SessionEnv running as SYSTEM and spawning interactive shells such as cmd.exe or powershell.exe.
New services, scheduled tasks, or local administrator accounts created shortly after a standard user logon on a host with Remote Desktop Services enabled.
Anomalous local RPC or named pipe traffic to Remote Desktop Services from unprivileged user sessions.

Detection Strategies

Hunt for privilege transitions where a standard user token is followed by a SYSTEM-context process on the same host within a short time window.
Correlate Windows Security event ID 4672 (special privileges assigned) with recent process creation (event ID 4688) originating from non-administrative users.
Baseline expected RDS service behavior and alert on child processes or module loads that deviate from that baseline.

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on all endpoints and servers running RDS.
Forward Sysmon process creation, image load, and pipe event logs to a central analytics platform for cross-host correlation.
Prioritize monitoring on session hosts, Remote Desktop gateway servers, and any multi-user Windows Server systems.

How to Mitigate CVE-2026-61365

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Advisory to every affected Windows client and server build.
Prioritize patching Remote Desktop Session Hosts, Remote Desktop Gateways, and multi-user servers where many low-privileged users have interactive access.
Audit local accounts and remove unnecessary interactive logon rights to reduce the pool of principals that can trigger the vulnerable path.
Review recent privilege escalation and service creation events on affected hosts for signs of pre-patch exploitation.

Patch Information

Microsoft has released security updates for all supported Windows client and server versions listed in the advisory. Administrators should deploy the corresponding cumulative update through Windows Update, WSUS, Microsoft Update Catalog, or their standard patch management tooling. Confirm the update KB installs cleanly and that the TermService restarts successfully after reboot.

Workarounds

Disable Remote Desktop Services on hosts that do not require it by setting the TermService startup type to Disabled and stopping the service.
Restrict interactive and Remote Desktop logon rights through Group Policy so that only administrators and vetted users can create local sessions.
Segment Remote Desktop hosts on isolated network zones and require multi-factor authentication at the gateway to limit exposure until patching is complete.

bash

# Configuration example: disable Remote Desktop Services where not required
sc.exe config TermService start= disabled
sc.exe stop TermService

# Verify the current state
sc.exe query TermService