CVE-2026-26159
Published: 14 April 2026
Summary
CVE-2026-26159 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26159 is a missing authentication vulnerability (CWE-306) in the Windows Remote Desktop Licensing Service. Published on 2026-04-14T18:16:48.123, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw stems from a critical function lacking proper authentication, enabling local privilege escalation for authorized attackers.
A low-privileged local user can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows the attacker to elevate privileges, resulting in high impacts to confidentiality, integrity, and availability on the affected system.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26159.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22382
Vulnerability details
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication (CWE-306) in Windows Remote Desktop Licensing Service directly enables local privilege escalation from low-privileged accounts (AV:L, PR:L) to SYSTEM-level access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses missing authentication for critical functions by requiring organizations to identify, document, review, and restrict actions permitted without identification or authentication, preventing privilege escalation in services like Remote Desktop Licensing.
Mandates timely identification, reporting, testing, and patching of flaws such as the missing authentication vulnerability in Windows Remote Desktop Licensing Service.
Enforces least privilege for users and processes, limiting the attack surface and impact of local privilege escalation from low-privileged accounts.