EUVD-2026-29636
GHSA-fpxw-597q-27v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WAC user
-
DeliveryReach network-exposed WAC gateway
-
ExploitInvoke action missing authorization check
-
ExecutionEscalate privileges over managed servers
-
ImpactAlter or disrupt server operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Windows Admin Center gateway and an existing low-privilege authenticated context (CVSS PR:L), so this is not a pre-authentication attack - the attacker must already possess valid low-level access to WAC or the network path to it. The affected deployment must be Windows Admin Center 1809.0 below version 2.6.5.16. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the authentication/privilege prerequisite and the need for WAC to be network-accessible are the primary limiting factors that constrain realistic exploitation. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, score 8.3) indicates a network-reachable, low-complexity attack requiring some existing privilege (PR:L) and no user interaction, with high integrity/availability impact - consistent with a privilege-escalation primitive for an already-authenticated user rather than a pre-auth breach. Signals partly conflict: EPSS is very low (0.05%, 16th percentile) and SSVC scores Exploitation as 'none' and Automatable as 'no', yet SSVC Technical Impact is 'total,' reflecting high damage potential if exploited. There is no KEV listing and no public exploit identified, so this reads as a high-severity-but-not-actively-exploited issue best prioritized on managed servers where WAC is internet- or broadly network-exposed. The PR:L requirement meaningfully limits blast radius to attackers who already hold a foothold or a low-privilege WAC account. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Windows Admin Center account (or has compromised such an account on the network) sends crafted requests to a WAC function that fails to enforce authorization, performing an administrative action they should not be permitted to run. This lets them escalate to high-impact control over managed servers without any user interaction; no public exploit is currently available, so exploitation would require original tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated, low-privileged network user to gain higher privileges by exploiting a missing authorization check (CWE-862). Successful exploitation yields high integrity and availability impact with limited confidentiality disclosure. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), but the CVSS base score of 8.3 and 'total' SSVC technical impact make it a meaningful risk in environments where WAC is exposed.
RemediationAI
Apply the vendor fix by upgrading Windows Admin Center to version 2.6.5.16 or later (Vendor-released patch: 2.6.5.16), following Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438. Until patching is complete, reduce exposure by restricting network access to the WAC gateway endpoint to a small set of trusted administrative hosts or a management VLAN (trade-off: legitimate remote admins must connect through the allowed path or a jump host), and tighten WAC role assignments so only necessary accounts hold gateway access, limiting the pool of PR:L attackers who could abuse the missing authorization check. These controls narrow reachability but do not remove the underlying flaw, so patching remains the priority.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Admin Center is Microsoft's browser-based, locally-deployed server management platform used to administer Windows Server and cluster infrastructure. The flaw is a CWE-862 Missing Authorization weakness, meaning the application performs a privileged action or exposes functionality without correctly verifying that the requesting principal is entitled to it. Per the CPE (cpe:2.3:a:microsoft:windows_admin_center), all builds in the 1809.0 line prior to 2.6.5.16 are affected. Because WAC brokers administrative operations against managed nodes, an authorization gap in this control plane can let a lower-privileged account invoke actions reserved for higher-privileged operators.
Know when Windows Admin Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Network-reachable gateway with low complexity but an existing low-privilege WAC account required (PR:L), yielding high integrity/availability and limited confidentiality impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Windows Admin Center hosts a high-severity privilege escalation vulnerability (CVE-2026-35438) allowing authenticated users to bypass authorization checks and gain elevated system privileges. Organizations managing hybrid or cloud infrastructure through WAC face integrity and availability risk if systems are not patched to version 2.6.5.16 or later, particularly when WAC is exposed to internal or network users. While no public exploit has been identified at time of analysis and public exploitation remains extremely unlikely (0.05% EPSS), the high CVSS score (8.3) and potential impact to infrastructure control systems warrant patching within 7 days.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center allows an authenticated local attacker with low privileges to gai
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Exploit-DB