Windows Remote Desktop Services 0-Day Vulnerability Exploited in the Wild to Escalate Privileges

The report details CVE-2026-21533, a high-severity RDS privilege escalation zero-day actively exploited to gain SYSTEM privileges by modifying service registry keys; it lists affected Windows Server and Windows 10/11 builds, provides mitigation guidance (disable RDS if unused, deploy patches and EDR, monitor registry changes), and notes Microsoft released fixes in the February 2026 Patch Tuesday while CrowdStrike observed exploit binaries in the wild.