Missing authentication for a critical function in the Windows Remote Desktop Licensing Service allows an attacker with local access to elevate privileges on the affected machine. The flaw corresponds to CWE-306 and can enable the attacker to perform privileged operations normally reserved for administrators. This results in a local privilege escalation that could compromise system integrity and confidentiality.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2, including their standard and Server Core installations.

The CVSS score of 7.8 classifies the issue as high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. The attack vector is local: an attacker must already have authenticated access to the target system. Once the attacker interacts with the vulnerable licensing service, they can gain elevated privileges. Immediate patching is recommended to mitigate this risk.