CVE-2026-61367 Overview
CVE-2026-61367 is a local privilege escalation vulnerability in Windows Remote Desktop Services. The flaw stems from missing authentication for a critical function [CWE-306]. An authorized attacker with low-privilege local access can leverage the weakness to elevate privileges on the affected system. Microsoft published the advisory on 2026-08-11, and the issue affects a broad range of Windows client and server releases including Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025.
Critical Impact
Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability of the compromised host, enabling full local compromise from a standard user context.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61367 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61367
Vulnerability Analysis
The vulnerability resides in Windows Remote Desktop Services, a component that provides remote session and terminal services functionality. A critical function within the service does not enforce authentication before executing privileged operations. An authenticated local user can invoke this function to perform actions reserved for higher-privileged accounts.
Because the attack vector is local and requires only low privileges without user interaction, exploitation is straightforward once a foothold exists on the host. The scope is unchanged, meaning the attacker gains elevated privileges within the same security authority. The EPSS probability at publication is approximately 0.284%, indicating no confirmed in-the-wild exploitation activity at this time.
Root Cause
The root cause is classified under [CWE-306]: Missing Authentication for Critical Function. A privileged code path in Remote Desktop Services is exposed without verifying that the caller holds the required rights. This design flaw allows low-privileged callers to reach functionality that should be gated behind an authentication or authorization check.
Attack Vector
Exploitation requires local access and a valid low-privilege account on the target Windows host. The attacker interacts with the exposed Remote Desktop Services function through inter-process communication available to standard users. Successful invocation results in code or actions executing at a higher privilege level, typically SYSTEM. Refer to the Microsoft Security Update Guide for CVE-2026-61367 for the authoritative technical description.
Detection Methods for CVE-2026-61367
Indicators of Compromise
- Unexpected child processes spawned by svchost.exe hosting Remote Desktop Services (TermService, SessionEnv, UmRdpService) running as SYSTEM after activity initiated by a non-privileged user.
- Anomalous local RPC or named-pipe connections to Remote Desktop Services endpoints from standard user sessions.
- Creation of new privileged accounts, scheduled tasks, or services shortly after low-privilege interactive logon events.
Detection Strategies
- Correlate Windows Security event ID 4672 (special privileges assigned) with the originating parent process to identify privilege elevation that lacks a legitimate administrative logon.
- Baseline normal callers of Remote Desktop Services RPC interfaces and alert on unusual invocations from user-context processes.
- Hunt for process lineage where a standard user process leads to a SYSTEM-level child via TermService or related RDS binaries.
Monitoring Recommendations
- Enable Sysmon process creation, image load, and pipe event logging on all Windows endpoints and servers with RDS roles.
- Forward RDS and Terminal Services operational logs to a centralized analytics platform for behavioral analysis.
- Track patch compliance across the affected Windows 10, Windows 11, and Windows Server SKUs to identify unpatched hosts.
How to Mitigate CVE-2026-61367
Immediate Actions Required
- Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2026-61367 to all affected Windows client and server builds.
- Prioritize patching hosts that permit interactive or Remote Desktop logon by non-administrative users, including jump boxes, RDS session hosts, and shared workstations.
- Audit local accounts and remove unnecessary interactive logon rights to shrink the pool of users who can trigger the flaw.
Patch Information
Microsoft has released cumulative security updates addressing CVE-2026-61367 for Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Refer to the Microsoft Security Update Guide for the specific KB article and build numbers applicable to each SKU.
Workarounds
- Where patching must be delayed, disable the Remote Desktop Services role on hosts that do not require it via Set-Service -Name TermService -StartupType Disabled after validating operational impact.
- Restrict local logon rights and remove standard users from the Remote Desktop Users group on sensitive systems.
- Enforce application control (Windows Defender Application Control or AppLocker) to block untrusted binaries that could invoke the vulnerable RDS interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
