EUVD-2026-45060
GHSA-279f-474x-phh7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N and PR:N reflect network-reachable delivery with no attacker auth; UI:R and S:C capture required victim interaction and browser-context scope crossing; no availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Windows Admin Center enables network-based spoofing attacks against users who interact with attacker-controlled content. The CVSS vector (AV:N/PR:N/UI:R/S:C) confirms that an unauthenticated remote attacker can deliver a crafted payload that executes in the victim's browser context once user interaction occurs, enabling session hijacking or administrative action spoofing within the management interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector PR:N confirms no attacker authentication is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no attacker privileges (PR:N) but mandating victim interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Windows Admin Center deployment accessible to IT administrators and crafts a malicious URL embedding an XSS payload targeting an unsanitized parameter in the web interface. The attacker sends this link to an IT administrator via a phishing email; when the administrator clicks the link while authenticated to Windows Admin Center, attacker-controlled JavaScript executes in the admin's browser session, enabling session token exfiltration or spoofed administrative actions. … |
| Remediation | Apply the vendor-released patch referenced in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58643. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows Admin Center
View allRemote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Privilege elevation in Microsoft Windows Admin Center allows an already-authenticated (low-privileged) network attacker
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.
Windows Admin Center fails to properly validate cryptographic signatures, enabling high-privileged users to bypass secur
Windows Admin Center Spoofing Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitabl
External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today