EUVD-2026-44044
GHSA-4f65-rfw9-ph2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryReach Admin Center gateway over network
-
ExploitExploit improper authentication check
-
ExecutionAssert elevated privileges
-
ImpactControl managed servers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged but authenticated position with network access to a Windows Admin Center gateway (CVSS PR:L, AV:N), and the target must be running an affected build in the 1809.0 to <2.7.4 range. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once those prerequisites are met, exploitation is straightforward. The limiting factors that reduce real-world risk are the mandatory low-privilege authentication (this is not exploitable by a fully unauthenticated outsider) and the requirement that the target be an unpatched Admin Center gateway reachable over the network - SSVC further rates exploitation as none and non-automatable. |
| Impact | The signals here are consistent but point to elevated-not-emergency risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows network-reachable, low-complexity, no-user-interaction exploitation that requires existing low-privilege access (PR:L), with total impact - matching SSVC's Technical Impact of 'total'. However, SSVC also records Exploitation: none and Automatable: no, and EPSS is only 0.49% (39th percentile), so widespread opportunistic exploitation is not indicated. There is no CISA KEV listing and no known POC. The PR:L requirement is the key limiter: an attacker must first hold a valid, if unprivileged, foothold within reach of the Admin Center gateway, which makes this a strong internal/insider or post-compromise escalation risk rather than a spray-and-pray internet threat. Prioritize patching for exposed or multi-tenant Admin Center gateways; the 8.8 score is credible but real-world urgency is moderated by the low EPSS, non-automatable SSVC signal, and authentication prerequisite. |
| Exploit ScenarioDerived | An attacker with a valid but low-privileged account that can reach a Windows Admin Center gateway sends crafted requests that exploit the improper authentication check to assert elevated privileges. Given AV:N/AC:L, the attack is network-based and low-complexity with no user interaction, allowing the attacker to gain administrative control over servers managed through the gateway. No public POC or active exploitation is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 21, 2026
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low-privileged network user bypass authentication controls (CWE-287) and gain higher privileges on the managed infrastructure. The flaw carries CVSS 8.8 with total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS is low at 0.49% (39th percentile). Microsoft has released a fixed build (2.7.4).
Earlier versions of this analysis (1)
Privilege elevation in Microsoft Windows Admin Center allows an already-authenticated (low-privileged) network attacker to bypass improper authentication controls and gain higher privileges, exposing high-value confidentiality and integrity impact. Rated CVSS 8.1 with low attack complexity and no user interaction, the flaw is remotely reachable but requires an existing authorized session. No public exploit identified at time of analysis; Microsoft has released a fix via the MSRC update guide.
RemediationAI
Vendor-released patch: 2.7.4 - upgrade Windows Admin Center to version 2.7.4 or later, following the Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56169. Because exploitation requires network reach plus a low-privilege authenticated foothold, effective interim compensating controls until patching is complete are to restrict network access to the Admin Center gateway port to a dedicated administrative subnet or jump host (limiting who can even reach the vulnerable endpoint, at the cost of requiring admins to connect via that path), and to tighten the set of accounts granted any Admin Center access and review gateway role assignments (reducing the pool of principals who could abuse the flaw, with the trade-off of added access-management overhead). These controls reduce exposure but do not remove the underlying authentication weakness, so upgrading to 2.7.4 remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Admin Center is Microsoft's browser-based, locally-deployed management console for Windows Server, clusters, and Windows client machines, effectively centralizing gateway access to sensitive server administration functions. The root cause is CWE-287 (Improper Authentication): the gateway does not correctly verify the identity or privilege boundary of a connecting principal, so an authenticated-but-lower-privileged user can assert or reach a privilege level they should not hold. Because Admin Center brokers administrative operations against downstream servers, an authentication weakness at the gateway layer translates directly into control over managed systems. The single affected product is confirmed by CPE cpe:2.3:a:microsoft:windows_admin_center:*.
Know when Windows Admin Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity privilege escalation requiring an existing low-privileged account (PR:L) with no user interaction and total impact on the managed host (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Windows Admin Center (versions 1809.0-2.7.3) contains a privilege escalation flaw enabling authenticated users to bypass administrative controls and gain elevated access to managed infrastructure systems. Organizations using WAC to administer their IT environment face potential compromise of multiple systems and loss of confidentiality, integrity, and availability of managed services.
Apply vendor patch (Windows Admin Center 2.7.4).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Privilege escalation in Microsoft Windows Admin Center allows an authenticated local attacker with low privileges to gai
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Exploit-DB