Windows Admin Center CVE-2026-58631

Exploitation requires the attacker to already be a local, authorized user (PR:L) on a system where Microsoft Windows Admin Center is installed and running, and to have local access to that host (AV:L) - this is a privilege-escalation/local-code-execution flaw, not a remote unauthenticated one. The improper authorization (CWE-285) is triggered by invoking a Windows Admin Center management function that fails to verify the caller's privilege level. Limiting factors that reduce real-world risk: the attacker must possess valid low-level credentials/access to the management host, the vulnerable Windows Admin Center software must be deployed there, and exploitation cannot be performed remotely without authentication; conversely, no user interaction is needed and attack complexity is low, so any lower-privileged local principal on such a host is a realistic threat.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a locally exploitable, low-complexity flaw needing existing low privileges and no user interaction, yielding full CIA impact on the affected system without scope change. This is a classic privilege-escalation/local-code-execution profile: dangerous once an attacker already has a foothold, but not internet-facing mass-exploitable. There is no KEV listing and no POC reported, and no EPSS score was supplied in the input, so widespread opportunistic exploitation is not indicated by available signals - treat this as 'no public exploit identified at time of analysis.' The signals are internally consistent (AV:L matches 'execute code locally'; PR:L matches 'authorized attacker'), so there is no CVSS-versus-description conflict to flag. Priority is moderate-to-high specifically for hosts running Windows Admin Center that are accessible to multiple or lower-trust local users; on single-admin management stations the practical exposure is lower.

A low-privileged but legitimate user of a server that hosts Windows Admin Center (for example a delegated operator or a local account) invokes a management operation whose authorization check is improperly enforced, causing the tool to execute attacker-supplied code in a higher-privilege context. With no user interaction and low attack complexity, the attacker escalates to full control of the host. No public proof-of-concept is currently identified.