CVE-2026-21533

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Feb 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-215357.5Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.CVE-2026-215369.8Microsoft Devices Pricing Program Remote Code Execution VulnerabilityCVE-2026-215378.8Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code ovCVE-2026-21546.1A vulnerability was identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Impacted is an unknown funCVE-2026-215487.5In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges neeCVE-2026-215497.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-21557.2A security flaw has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz oCVE-2026-215507.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215517.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215527.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215537.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegesCVE-2026-215547.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges
CVE-2026-21533: High severity, CVSS 7.8 | Vulnix