Windows Admin Center
CVE-2025-64669
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold on WAC host
-
DeliveryAuthenticate as limited user
-
ExploitAbuse improper access control in Windows Admin Center
-
ExecutionExecute privileged operations
-
ImpactGain administrator/SYSTEM-level control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated, low-privileged local access (PR:L, AV:L) on a system where Windows Admin Center is installed and running; it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N). The limiting factors are the prerequisite local foothold, the existing low-level privileges, and the requirement that the target actually has Windows Admin Center deployed - a management tool not present on all Windows servers. Specific configuration prerequisites are not detailed in the available MSRC advisory. |
| Impact | CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector, low complexity, and a requirement that the attacker already hold some privileges (PR:L) on a host running Windows Admin Center. The high C/I/A impact reflects full privilege escalation on the affected host. EPSS is low at 0.47% (39th percentile), the CVE is NOT listed on CISA KEV, and no public exploit code was identified in the provided sources, so all three exploitation signals are mutually consistent and point to low near-term mass-exploitation likelihood. This is a credible but secondary priority: it is a local privilege-escalation requiring an existing authenticated foothold rather than a remotely exploitable, unauthenticated flaw, so it functions mainly as a post-compromise escalation step. It should be patched on normal cycles, prioritized where WAC runs on sensitive management hosts. No signals conflict; the main limitation is reliance on Microsoft's MSRC advisory, which by convention provides minimal technical detail. |
| Exploit ScenarioDerived | An attacker who has already obtained low-privileged, authenticated local access to a server running Windows Admin Center abuses the improper access control flaw to perform privileged operations they should not be allowed to perform, elevating to full administrative/SYSTEM-level control of the host. No public proof-of-concept was identified, and exploitation requires prior local access with low-level privileges per the CVSS vector (AV:L/PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Privilege escalation in Microsoft Windows Admin Center allows an authenticated local attacker with low privileges to gain elevated rights on affected installations. The vulnerability has a CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring a local foothold and existing low-level privileges, and successful exploitation can have high confidentiality, integrity, and availability impact. The EPSS score is 0.47% (39th percentile), and no public exploit code or confirmed active exploitation was identified in the provided data.
RemediationAI
Apply the Microsoft security update referenced by the MSRC advisory for CVE-2025-64669; the provided data does not include an exact patched version, so confirm the fixed Windows Admin Center build in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64669. If patching must be delayed, reduce exposure by restricting interactive local logon rights on systems hosting Windows Admin Center to trusted administrators, removing Windows Admin Center from hosts where it is not operationally required, and auditing for unexpected privilege use or manipulation of the Windows Admin Center service; these controls have trade-offs, since restricting logon can impede legitimate administration and uninstalling Windows Admin Center removes its management capability. Also apply least privilege to local accounts and monitor for local privilege-escalation behavior, while recognizing that these compensating controls do not replace the vendor fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Windows Admin Center is a browser-based management gateway used to administer Windows Servers, clusters, and related infrastructure. The root cause is CWE-284 (Improper Access Control), meaning the product does not correctly enforce authorization boundaries, allowing a user who already has local low-privileged access to perform actions beyond their intended permissions. The supplied CPE string cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:* identifies the affected product family without version specificity. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms a local attack vector, low complexity, no user interaction, and unchanged scope, so this is not a remote or unauthenticated issue in the assessed conditions. The reference tag “Authentication Bypass” should be read in the context of an access-control bypass that leads to privilege elevation; the assessed vector still requires an existing low-privileged local foothold (PR:L). Specific vulnerable code paths or configuration prerequisites are not detailed in the available MSRC advisory.
Know when Windows Admin Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an existing authenticated low-privileged user (AV:L, PR:L), easily triggered (AC:L), yielding full host compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows Admin Center contains a high-severity privilege escalation vulnerability (CVE-2025-64669) that allows an authenticated local attacker with low privileges to gain elevated rights on affected installations. No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Organizations using this tool for Windows server management are at risk, as successful exploitation could lead to full compromise of confidentiality, integrity, and availability of managed systems, making it critical for leadership to address exposure.
No vendor patch available. Interim mitigations include restricting local interactive logon to trusted users, enforcing least privilege, monitoring for suspicious privilege escalation attempts, and disabling Windows Admin Center if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
GitHub PoC
Exploit-DB