Microsoft disclosed CVE-2026-40398 on May 12, 2026, as an Important-rated Windows Remote Desktop Services elevation-of-privilege vulnerability, with no public disclosure or active exploitation reported at release time and a CVSS base score of 7.8. That combination is easy to misread: not a...