EUVD-2026-44044
GHSA-4f65-rfw9-ph2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity privilege escalation requiring an existing low-privileged account (PR:L) with no user interaction and total impact on the managed host (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low-privileged network user bypass authentication controls (CWE-287) and gain higher privileges on the managed infrastructure. The flaw carries CVSS 8.8 with total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS is low at 0.49% (39th percentile). Microsoft has released a fixed build (2.7.4).
Technical ContextAI
Windows Admin Center is Microsoft's browser-based, locally-deployed management console for Windows Server, clusters, and Windows client machines, effectively centralizing gateway access to sensitive server administration functions. The root cause is CWE-287 (Improper Authentication): the gateway does not correctly verify the identity or privilege boundary of a connecting principal, so an authenticated-but-lower-privileged user can assert or reach a privilege level they should not hold. Because Admin Center brokers administrative operations against downstream servers, an authentication weakness at the gateway layer translates directly into control over managed systems. The single affected product is confirmed by CPE cpe:2.3:a:microsoft:windows_admin_center:*.
RemediationAI
Vendor-released patch: 2.7.4 - upgrade Windows Admin Center to version 2.7.4 or later, following the Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56169. Because exploitation requires network reach plus a low-privilege authenticated foothold, effective interim compensating controls until patching is complete are to restrict network access to the Admin Center gateway port to a dedicated administrative subnet or jump host (limiting who can even reach the vulnerable endpoint, at the cost of requiring admins to connect via that path), and to tighten the set of accounts granted any Admin Center access and review gateway role assignments (reducing the pool of principals who could abuse the flaw, with the trade-off of added access-management overhead). These controls reduce exposure but do not remove the underlying authentication weakness, so upgrading to 2.7.4 remains the definitive fix.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Windows Admin Center fails to properly validate cryptographic signatures, enabling high-privileged users to bypass secur
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today