EUVD-2026-45060
GHSA-279f-474x-phh7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AV:N and PR:N reflect network-reachable delivery with no attacker auth; UI:R and S:C capture required victim interaction and browser-context scope crossing; no availability impact applies.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
AnalysisAI
Cross-site scripting in Microsoft Windows Admin Center enables network-based spoofing attacks against users who interact with attacker-controlled content. The CVSS vector (AV:N/PR:N/UI:R/S:C) confirms that an unauthenticated remote attacker can deliver a crafted payload that executes in the victim's browser context once user interaction occurs, enabling session hijacking or administrative action spoofing within the management interface. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Technical ContextAI
Windows Admin Center is a browser-based, agentless server management platform deployed in Windows enterprise environments. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-controlled input is insufficiently sanitized before being rendered in HTML output served by the application. The CVSS Scope:Changed (S:C) metric confirms the injected script crosses trust boundaries - executing in the victim's browser context rather than remaining isolated to the server-side component. The CPE string cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:* uses a wildcard on version, indicating NVD has not constrained the affected range to a specific release, implying broad version exposure across all shipped releases.
RemediationAI
Apply the vendor-released patch referenced in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58643. The advisory is tagged as a patch release; however, the exact fixed version number is not independently confirmed from available data and should be verified directly against the MSRC advisory. As a compensating control prior to patching, restrict network access to the Windows Admin Center gateway to trusted internal subnets or VPN-only segments, preventing external delivery of crafted XSS payloads to administrative users. Additionally, enforce browser-level Content Security Policy headers if the deployment supports custom configuration - this can constrain script execution scope even if the XSS is triggered. Note that network restriction does not eliminate insider or phishing risk from within the trusted network.
More in Windows Admin Center
View allPrivilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege acces
Privilege elevation in Microsoft Windows Admin Center (versions 1809.0 through 2.7.3) lets an already-authenticated, low
An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s
Local privilege-to-code-execution in Microsoft Windows Admin Center lets an already-authenticated, lower-privileged user
Local privilege escalation in Microsoft Windows Admin Center allows an already-authenticated, low-privileged attacker to
Windows Admin Center's authentication mechanism can be bypassed by authenticated network users to gain elevated privileg
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated
Windows Admin Center in Azure Portal contains an access control flaw that enables local authenticated users to escalate
Improper authentication in Windows Admin Center (versions prior to 2.6.5.16) enables an authenticated low-privilege atta
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4)
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today