CVE-2026-21533: CWE-269: Improper Privilege Management in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-21533) arises from improper privilege management in the Windows Remote Desktop feature of Windows 10 Version 1607 (build 10.0.14393.0). An attacker who is already authorized and has local access can exploit this flaw to elevate their privileges, potentially gaining higher-level access than intended. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has acknowledged the issue and provided an official fix to remediate it.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. This could enable the attacker to perform actions beyond their original permissions on the affected system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 to remediate this vulnerability. Since this is a local privilege escalation, limiting local access to trusted users also reduces risk. No additional mitigations are indicated by the vendor advisory.