What is the CVSS score of CVE-2026-41086?

CVE-2026-41086 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Admin Center are affected by CVE-2026-41086?

Windows Admin Center in Azure Portal contains a privilege escalation defect (versions prior to 2.6.7) allowing low-privileged authenticated users to assume full administrative control.. A patch is available.

How to fix or mitigate CVE-2026-41086?

Within 24 hours: Identify all Azure Portal Windows Admin Center instances running versions 1.0 through 2.6.6 using Azure resource inventory and administrative consoles. Within 7 days: Apply Microsoft's vendor patch to upgrade all affected instances to version 2.6.7 or later, prioritizing production management systems and privileged administrative workstations. Within 30 days: Audit all administrative activity logs in Windows Admin Center during the vulnerability window to detect privilege escalation attempts, and implement enhanced conditional access policies restricting low-privilege user access to sensitive management functions.

Windows Admin Center CVE-2026-41086

EUVD-2026-29679 HIGH

Improper Access Control (CWE-284)

2026-05-12 microsoft

GHSA-3w55-v67h-rqff

Authentication Bypass Microsoft Windows Admin Center In Azure Portal

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-reachable management surface (AV:N) with low complexity and no user interaction, but requires an existing low-privilege account (PR:L); improper access control yields total control, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:06 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

HIGH 8.8

DescriptionCVE.org

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Windows Admin Center in Azure Portal (versions 1.0 up to but not including 2.6.7) lets an already-authenticated, low-privileged network user gain higher privileges by abusing improper access control (CWE-284). Microsoft reports a patch is available; there is no public exploit identified at time of analysis and EPSS probability is low (0.06%). Tagged as an authentication-bypass class issue, successful exploitation yields total control (high confidentiality, integrity, and availability impact) over the affected management surface.

Technical ContextAI

Windows Admin Center (WAC) is Microsoft's browser-based server management platform; this CVE concerns the Azure Portal-hosted variant identified by CPE cpe:2.3:a:microsoft:windows_admin_center_in_azure_portal. The root cause is CWE-284 (Improper Access Control): an authorization check is missing or incorrectly enforced on a network-reachable operation, allowing a principal who already holds some legitimate (low) access to perform actions reserved for higher-privileged roles. Because WAC brokers administrative operations against managed Windows servers, an authorization gap in its access-control layer translates directly into elevated administrative capability rather than a narrow data leak.

RemediationAI

Vendor-released patch: upgrade Windows Admin Center in Azure Portal to version 2.6.7 or later, which is the first release outside the affected range per the EUVD data; consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41086 for exact deployment guidance. Because this is the Azure Portal-hosted variant, ensure the extension/service is updated to the fixed build rather than relying on local installers. As interim compensating controls until patched, restrict who holds any WAC access by tightening Azure RBAC role assignments to remove unnecessary low-privilege operators (this reduces the pool of principals who satisfy the PR:L precondition, at the cost of some operational convenience), and closely monitor WAC administrative actions and role-elevation events for anomalies. These controls narrow exposure but do not close the underlying authorization gap, so patching to 2.6.7 remains the definitive fix.