Hackers Allegedly Selling Exploit for Windows Remote Desktop Services 0-Day Flaw

A threat actor is advertising a purported weaponized zero-day exploit for Windows Remote Desktop Services (CVE-2026-21533) on a dark web forum for $220,000, claiming it enables local privilege escalation to administrative control; Microsoft published the vulnerability in February 2026 (CVSSv3 7.8) and it is listed in CISA's Known Exploited Vulnerabilities catalog. Organizations are urged to apply Microsoft patches, follow CISA guidance, disable RDS if not required, restrict access to trusted networks, and deploy EDR to monitor for privilege escalation attempts.