This vulnerability (CVE-2026-26159) affects Windows 10 Version 1607 (build 10.0.14393.0) and is classified under CWE-306 (Missing Authentication for Critical Function). It involves the Windows Remote Desktop Licensing Service, where a critical function lacks proper authentication controls. As a result, an attacker with local authorized access can elevate their privileges, impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.8 (high), reflecting local attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this vulnerability, and users should consult the vendor advisory for patch deployment.

An authorized local attacker can exploit this vulnerability to elevate privileges on the affected Windows 10 Version 1607 system. This elevation can lead to full system compromise, affecting confidentiality, integrity, and availability of the system. No known exploits are currently reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft security update for CVE-2026-26159 as detailed in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26159). Applying this update will remediate the missing authentication issue in the Windows Remote Desktop Licensing Service. No additional mitigation steps are indicated by the vendor advisory.