EUVD-2026-43757
GHSA-rgqw-chxv-cccq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible with low complexity; prior authentication required (PR:L); purely an information disclosure with no write or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.
AnalysisAI
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege attacker over a network to bypass authentication controls and access sensitive information beyond their authorized scope. The flaw is classified as CWE-287 (Improper Authentication) and affects all Windows Admin Center 1809.0 installations below the patched release. No public exploit code has been identified and CISA has not listed this in KEV, indicating no confirmed active exploitation at the time of analysis.
Technical ContextAI
Windows Admin Center (CPE: cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:*) is Microsoft's browser-based, locally deployed server and cluster management gateway, commonly used in enterprise environments to manage Windows Server infrastructure. The root cause is CWE-287 (Improper Authentication), meaning the application fails to correctly verify the identity or privilege level of authenticated requests - a logic flaw rather than a credential-theft scenario. Because the CVSS vector specifies PR:L (low privileges required), the vulnerability is triggered by an already-authenticated but under-privileged session, where the platform does not adequately enforce access boundaries between low and higher-privilege data contexts. This is consistent with the 'Authentication Bypass' tag: the attacker's existing session token is accepted for resource requests that should require elevated privilege.
RemediationAI
Upgrade Windows Admin Center to version 2.6.5.16 or later, as confirmed by the vendor-released patch documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56185. This is the primary and recommended fix. If immediate patching is not possible, restrict network access to the Windows Admin Center gateway port (default TCP 443/6516) to only trusted administrative subnets using host-based or perimeter firewall rules - this does not eliminate the vulnerability but reduces the attack surface to accounts already on the management network. Additionally, auditing and minimizing the number of accounts with any level of Windows Admin Center access limits the population of potential abusers. Disabling Windows Admin Center entirely and reverting to legacy management tools (RDP, Server Manager, PowerShell remoting) is a high-impact workaround if the management platform is non-essential, but carries operational overhead.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Windows Admin Center fails to properly validate cryptographic signatures, enabling high-privileged users to bypass secur
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today