Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-21533

Microsoft Windows Improper Privilege Management Vulnerability

7.8
CVSS 3.1
1
story
FEB 10
added to KEV
Severity
7.8 High · vendor score
Vendor
Microsoft
Product
Windows
Published
Feb 10, 2026
Added to KEV
Feb 10, 2026
KEV deadline
Mar 3, 2026
Ransomware use
Unknown
Weakness
CWE-269

What it is

Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533Fixvicarius.io/vsociety/posts/cve-2026-21533-mitigation-script-privilege-escalation-vulnerability-in-windows-remote-desktopAnalysisvicarius.io/vsociety/posts/cve-2026-21533-detection-script-privilege-escalation-vulnerability-in-windows-remote-desktop