CVE-2026-68893: Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Microsoft’s Security Update Guide describes the flaw as a use-after-free vulnerability, tracked as CWE-416. Its advisory states: “Windows Remote Desktop Licensing Service Elevation of Privilege Vulnerability: Use after free in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges over a network.” The supplied Microsoft advisory record was published September 8, 2026.

The update coverage is broader than the service name may initially suggest. It includes legacy Windows 10 releases and Windows Server generations from Windows Server 2012 through Windows Server 2025, including Server Core installations. Organizations with Remote Desktop licensing infrastructure should treat the listed cumulative updates as a patch-verification task: install the applicable KB, then confirm the resulting operating-system build rather than relying only on deployment status.

What Microsoft says the attack requires​

CVE-2026-68893 carries the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The network attack vector means the vulnerable service can be reached over a network, while the low-privileges requirement and user-interaction requirement mean this is not described as an unauthenticated, one-packet compromise.

Microsoft’s CVSS explanation adds an important operational detail: “Successful exploitation of this vulnerability requires an attacker to win a race condition.” A race condition is a timing-sensitive state in which the attacker must cause operations to occur in a narrow and favorable order. That requirement is reflected in the High attack-complexity rating, but it does not reduce the impact after success.

Microsoft explicitly answers the privilege question in its advisory: “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.” In practice, SYSTEM-level code execution can permit changes to local security settings, services, stored data, and other workloads running on the affected server. For Remote Desktop licensing hosts, that makes the flaw relevant to administrators who separate licensing roles from session hosts but may not apply the same patch urgency to the licensing server itself.

The scoring record lists a 6.2 temporal score alongside the 7.1 base score. Microsoft’s published assessment is Exploitation Less Likely.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

Affected Windows products and fixed builds​

Microsoft maps the vulnerability to five updates and fixed-build targets. The overlap is significant for mixed estates: KB5123099 applies to both Windows 10 Version 1607 and Windows Server 2016; KB5122876 applies to Windows 10 Version 1809 and Windows Server 2019. Administrators should match the installed product precisely, especially where Server Core and full server installations coexist.

Patch deployment should be verified by build number​

The practical value of Microsoft’s KB-to-build mapping is that it gives administrators an unambiguous endpoint for remediation. A management console may report an update installed while a machine remains pending restart, has failed to complete servicing, or is reporting an older build. The build target provides the post-installation validation point.

For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows 10 Version 1607 for x64-based Systems, install KB5123099 to reach fixed build 10.0.14393.9512. For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245. For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.

For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349. For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349. For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23397. For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23397.

For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512. For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245. For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.

For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622. For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622. For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438. For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.

Prioritize Remote Desktop licensing hosts​

The Remote Desktop Licensing Service is a distinct Windows role, so asset inventories based solely on “RDP enabled” or session-host classifications may miss servers that need review. Administrators should identify servers running the licensing function, match their installed Windows release and architecture to Microsoft’s product mapping, deploy the applicable update, restart where servicing requires it, and record the resulting fixed build.

Microsoft’s assessment that exploitation is less likely should shape prioritization, not postpone remediation. CVE-2026-68893 requires specific conditions—authorization, user interaction, and a race-condition win—but the documented post-exploitation result is SYSTEM privilege. The immediate operational target is therefore clear: every affected Remote Desktop Licensing Service host should be brought to its Microsoft-specified fixed build.