This vulnerability (CVE-2026-26160) involves missing authentication controls in a critical function of the Windows Remote Desktop Licensing Service on Windows 10 Version 1607 (build 10.0.14393.0). An attacker with local authorized access can exploit this flaw to elevate their privileges, potentially gaining higher system rights. The CVSS v3.1 base score is 7.8, reflecting high impact with low attack complexity and no user interaction required. Microsoft has released an official fix to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially leading to full system compromise affecting confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

An official patch is available from Microsoft to fix this vulnerability. It is recommended to apply the update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26160 promptly to mitigate the risk. No additional mitigation steps are indicated by the vendor.