CVE-2026-69292: Remote Desktop Gateway Service Elevation of Privilege Vulnerability

Microsoft’s MSRC advisory describes the flaw as a double-free vulnerability in Remote Desktop Gateway Service. A successful attacker could elevate privileges locally, changing their security context from an authorized account to SYSTEM—the highest local privilege level in Windows. Administrators should treat this as a patch-verification task as well as a deployment task: the correct cumulative update varies by operating-system generation, while Server Core and full-server installations share the same update and fixed build for each release.

CVE-2026-69292: Severity, scoring, and attack requirements​

The exact title is Remote Desktop Gateway Service Elevation of Privilege Vulnerability. Microsoft rates CVE-2026-69292 as Important, with a CVSS base score of 7.0 and a temporal score of 6.1.

Its CVSS vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The vector identifies local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability.

The weakness is classified as CWE-415, a double-free condition. Microsoft’s description is explicit: “Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally.”

Microsoft further states that a successful exploit would give the attacker SYSTEM privileges. The advisory also explains the high attack-complexity rating: successful exploitation requires an attacker to win a race condition. That requirement does not remove the need to patch; it defines the conditions under which an already authorized local attacker could turn a foothold into full machine-level control.

Publicly disclosed: No

Exploited: No

Customer action required: Yes

Microsoft’s exploitation assessment is Exploitation Unlikely.

Remote Desktop Gateway Service turns a local foothold into SYSTEM​

This is an elevation-of-privilege issue, rather than a remote unauthenticated entry point. The advisory says the attacker must be authorized and must exploit the flaw locally. The operational risk is therefore concentrated in systems where an attacker has already acquired credentials, code execution, interactive access, or another legitimate-but-limited local position.

SYSTEM access has material consequences on a Windows server. It can place an attacker above ordinary local administrators in many security-sensitive operations, including actions involving protected processes, services, registry areas, system files, and credential-related components. Microsoft’s advisory does not describe a complete attack chain; its finding is narrower and important on its own: Remote Desktop Gateway Service contains a condition that can convert authorized local access into SYSTEM privileges if the attacker can satisfy the race-condition requirement.

The broad server coverage is the detail administrators should not overlook. CVE-2026-69292 affects both Server Core installation options and conventional x64 installations for Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. The inclusion of the older server generations means update teams cannot assume that newer servicing rings are the only ones requiring attention.

Windows 10 Version 1607 and Windows 10 Version 1809 are also included for both 32-bit and x64 systems. Those client releases use the same applicable KB packages as their server counterparts on the corresponding servicing baseline: KB5123099 for Version 1607 and Windows Server 2016, and KB5122876 for Version 1809 and Windows Server 2019.

Required KBs and fixed build targets​

The remediation should be validated against Microsoft’s stated fixed build rather than treated simply as an update-installation checkbox. For a mixed estate, that means matching each device’s product and architecture to the correct KB, then confirming it reaches the listed build.

Patch verification needs to include Server Core​

The KB mapping produces four practical deployment groups. KB5123065 is the Windows Server 2012 fix, bringing affected systems to build 6.2.9200.26349. KB5123066 is for Windows Server 2012 R2, with fixed build 6.3.9600.23397.

KB5123099 covers Windows 10 Version 1607 and Windows Server 2016, with a fixed build of 10.0.14393.9512. KB5122876 covers Windows 10 Version 1809 and Windows Server 2019, with a fixed build of 10.0.17763.9245. Newer server releases split into KB5122882 for Windows Server 2022, fixed at 10.0.20348.5622, and KB5122871 for Windows Server 2025, fixed at 10.0.26100.33438.

For administrators, the useful distinction is that Server Core is not a separate patch stream here. Each Server Core listing reaches the same fixed build as its corresponding x64 full-server product. Asset inventories that separate Core and Desktop Experience deployments can therefore use the same KB-and-build target within each Windows Server version, while still confirming that every individual installation has received the update.

CVE-2026-69292 is a local, authorized-attacker elevation-of-privilege issue with high attack complexity, but the potential outcome is SYSTEM. Microsoft has assigned customer action, and the concrete completion point is clear: install the matching KB and verify the device has reached its specified fixed build.