What is the CVSS score of CVE-2026-35438?

CVE-2026-35438 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Admin Center are affected by CVE-2026-35438?

Microsoft Windows Admin Center hosts a high-severity privilege escalation vulnerability (CVE-2026-35438) allowing authenticated users to bypass authorization checks and gain elevated system…. A patch is available.

How to fix or mitigate CVE-2026-35438?

Immediately within 24 hours, identify all Windows Admin Center deployments in your environment and confirm their current version to establish baseline inventory and risk. Execute patch deployment to upgrade all affected systems to Windows Admin Center version 2.6.5.16 or later within 7 days, prioritizing any systems managing production infrastructure. Complete post-patch verification within 30 days by confirming all systems are running the patched version, review administrative access logs for unusual privilege escalation attempts, and implement network access controls to restrict WAC management interfaces to authorized administrative segments only.

Windows Admin Center CVE-2026-35438

EUVD-2026-29636 HIGH

Missing Authorization (CWE-862)

2026-05-12 microsoft

GHSA-fpxw-597q-27v2

Microsoft Authentication Bypass Windows Admin Center

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable gateway with low complexity but an existing low-privilege WAC account required (PR:L), yielding high integrity/availability and limited confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:10 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 8.3

DescriptionCVE.org

Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated, low-privileged network user to gain higher privileges by exploiting a missing authorization check (CWE-862). Successful exploitation yields high integrity and availability impact with limited confidentiality disclosure. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), but the CVSS base score of 8.3 and 'total' SSVC technical impact make it a meaningful risk in environments where WAC is exposed.

Technical ContextAI

Windows Admin Center is Microsoft's browser-based, locally-deployed server management platform used to administer Windows Server and cluster infrastructure. The flaw is a CWE-862 Missing Authorization weakness, meaning the application performs a privileged action or exposes functionality without correctly verifying that the requesting principal is entitled to it. Per the CPE (cpe:2.3:a:microsoft:windows_admin_center), all builds in the 1809.0 line prior to 2.6.5.16 are affected. Because WAC brokers administrative operations against managed nodes, an authorization gap in this control plane can let a lower-privileged account invoke actions reserved for higher-privileged operators.

RemediationAI

Apply the vendor fix by upgrading Windows Admin Center to version 2.6.5.16 or later (Vendor-released patch: 2.6.5.16), following Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35438. Until patching is complete, reduce exposure by restricting network access to the WAC gateway endpoint to a small set of trusted administrative hosts or a management VLAN (trade-off: legitimate remote admins must connect through the allowed path or a jump host), and tighten WAC role assignments so only necessary accounts hold gateway access, limiting the pool of PR:L attackers who could abuse the missing authorization check. These controls narrow reachability but do not remove the underlying flaw, so patching remains the priority.