What is the CVSS score of CVE-2026-58631?

CVE-2026-58631 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows Admin Center are affected by CVE-2026-58631?

Microsoft Windows Admin Center contains an improper authorization vulnerability allowing authenticated lower-privileged users to escalate privileges and execute arbitrary code on the management host.. A patch is available.

How to fix or mitigate CVE-2026-58631?

Within 24 hours, inventory all systems running Microsoft Windows Admin Center and assess exposure by identifying which lower-privileged accounts have access. Within 7 days, apply the vendor-released patch from Microsoft's MSRC update guide to all affected installations. Within 30 days, verify patch deployment across all systems, review access logs for unauthorized privilege escalation attempts, and implement access controls restricting Windows Admin Center usage to authorized administrative personnel.

Windows Admin Center CVE-2026-58631

EUVD-2026-43775 HIGH

Improper Authorization (CWE-285)

2026-07-14 microsoft

GHSA-865x-g7fg-mwh4

Authentication Bypass Microsoft Windows Admin Center

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local code execution by an already-authorized low-privileged user gives AV:L/PR:L/AC:L with no user interaction and full CIA impact, matching the vendor vector.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:48 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.

AnalysisAI

Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user abuse an improper authorization check (CWE-285) to run arbitrary code on the host where the management tool is installed. Rated CVSS 7.8 with high confidentiality, integrity, and availability impact, it requires local access and existing low-level privileges rather than remote unauthenticated reach. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but Microsoft has released a fix via the MSRC update guide.

Technical ContextAI

Windows Admin Center is Microsoft's browser-based, locally deployed server-management console used to administer Windows Server and Windows client machines (roles, services, PowerShell, storage, networking) as a modern replacement for various MMC snap-ins. The CPE cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:* confirms the Microsoft Windows Admin Center application is the affected component across unspecified versions. The root cause is CWE-285 (Improper Authorization): the application fails to correctly enforce that the acting principal is permitted to perform a given operation, so an actor who is authorized for some lower-privileged function can invoke a privileged code-execution path they should be denied. The vendor tag 'Authentication Bypass' points to a broken privilege/authorization boundary within the management plane rather than a memory-corruption bug.

RemediationAI

Patch available per vendor advisory: apply the Microsoft-supplied update for Windows Admin Center referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58631, consulting that page for the exact fixed build (specific patched version not enumerated in the provided data, so do not assume a version number). Because exploitation requires local, already-authorized access, effective compensating controls until patching include restricting interactive and remote-desktop logon rights to the host running Windows Admin Center to trusted administrators only, removing lower-privileged users from that machine, and limiting who can reach the Windows Admin Center gateway/service; the trade-off is reduced delegated administration and possible workflow friction for helpdesk or junior operators who legitimately use the console. Monitor for anomalous local process creation and privilege use on management hosts as a detection backstop.