The CVSS 7.8 on CVE-2026-61365 is misleading. It treats this as a contained local privilege escalation when the real impact flows through Remote Desktop Services as a connectivity hub. The vulnerability — missing authentication on a critical RDS function — isn't a cryptographic failure or a logic error. It's a decision: someone shipped code that strips authentication from a function that exists specifically to serve authenticated sessions. That requires either active ignorance of the security model or a deliberate override of it. Either way, it's a process failure that passed through code review as 'internal infrastructure.'
What should concern you more than this specific CVE: the blast radius it opens. A local privilege escalation on RDS doesn't end at the user's session — it opens the chain. SYSTEM on an RDS host frequently means access to authentication brokers, credential stores, and session replay infrastructure. The CVSS scores a node; you're defending a network. The 'local only' framing is an artifact of how the researcher demonstrated impact, not a genuine boundary in the code.
Your immediate priorities: First, pull the git history on the affected function and determine whether authentication was removed mid-development (regression) or never authored in the first place (design failure). These require different remediation strategies — process controls versus architectural review. Second, treat this as a class of vulnerability, not an instance. The organizational assumption that 'internal code doesn't need auth' recurs across decades of infrastructure CVEs. The same assumption almost certainly lives in other functions under the RDS umbrella. Audit for the pattern: any code path designed under the assumption that caller context is trusted. Those assumptions manifest as absences, not violations, and won't show up in standard code review.
Third, reclassify your remediation urgency. The CVSS 'high' anchors this to normal patch cadence, but a connectivity hub with a multi-week disclosure-to-patch window, combined with an unexamined organizational trust model, creates compounding exposure. You're not patching a vulnerability — you're paying down debt that likely has siblings.