⚠ Actively exploited
Added to CISA KEV on 2026-02-10. Federal agencies required to patch by 2026-03-03. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2026-21533

CWE-269 — Improper Privilege Management9 documents8 sources
Severity
7.8HIGH
EPSS
22.7%
top 4.13%
CISA KEV
KEV
Added 2026-02-10
Due 2026-03-03
Exploit
No known exploits
Affected products
28
Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1809Microsoft Windows 10 Version 21h2+25 more
Timeline
PublishedFeb 10
KEV addedFeb 10
KEV dueMar 3
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages28 packages

▶NVDmicrosoft/windows< 10.0.14393.8868+5
▶NVDmicrosoft/windows_10_1607< 10.0.14393.8868
▶NVDmicrosoft/windows_10_1809< 10.0.17763.8389
▶NVDmicrosoft/windows_10_21h2< 10.0.19044.6937
▶NVDmicrosoft/windows_10_22h2< 10.0.19045.6937

🔴Vulnerability Details

3
GHSA
GHSA-qppx-835v-jvwp: Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally↗2026-02-10
▶
CVEList
Windows Remote Desktop Services Elevation of Privilege Vulnerability↗2026-02-10
▶
VulnCheck
Microsoft Windows Improper Privilege Management Vulnerability↗2026
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Improper Privilege Management Vulnerability↗2026-02-10
▶
Microsoft
Windows Remote Desktop Services Elevation of Privilege Vulnerability↗2026-02-10
▶

🕵️Threat Intelligence

2
Krebs
Patch Tuesday, February 2026 Edition↗2026-02-10
▶
Wiz
CVE-2026-21533 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-21533 (HIGH CVSS 7.8) | Improper privilege management in Wi | cvebase.io