Windows Admin Center CVE-2026-58643

The CVSS vector PR:N confirms no attacker authentication is required. However, UI:R is a hard prerequisite - a victim with an active or recent Windows Admin Center session must be induced to interact with attacker-controlled content, such as clicking a crafted hyperlink. The attack operates over the network (AV:N) with low complexity (AC:L), meaning no special tooling or timing is required beyond delivering the payload URL. Exploitation is concretely limited by two factors: first, the victim must be an IT administrator or operator with access to Windows Admin Center, narrowing the viable target pool; second, Windows Admin Center is typically deployed on internal management networks or behind VPN, requiring the attacker to either have internal network access or compromise an admin's email/communication channel to deliver the phishing link. No server-side non-default configuration is required for the vulnerability to be present.

The CVSS 6.1 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no attacker privileges (PR:N) but mandating victim interaction (UI:R). The Scope:Changed flag elevates real-world impact beyond the raw score - attacker JavaScript executing in an IT administrator's active session can exfiltrate session tokens, perform actions on behalf of the admin, or deliver further payloads. EPSS data was not provided in available intelligence, limiting probabilistic exploitation forecasting. No KEV listing exists and no public exploit has been identified, suggesting exploitation remains opportunistic or targeted rather than automated at scale. The primary risk-limiting factor is deployment context: Windows Admin Center is typically accessible only to administrative personnel on internal or VPN-connected networks, significantly narrowing the attacker's delivery surface compared to a public-facing web application. Despite PR:N, reaching the endpoint to deliver the XSS payload still requires network proximity to the management interface.

An attacker identifies a Windows Admin Center deployment accessible to IT administrators and crafts a malicious URL embedding an XSS payload targeting an unsanitized parameter in the web interface. The attacker sends this link to an IT administrator via a phishing email; when the administrator clicks the link while authenticated to Windows Admin Center, attacker-controlled JavaScript executes in the admin's browser session, enabling session token exfiltration or spoofed administrative actions. No public exploit code has been identified at time of analysis, suggesting this scenario currently requires custom payload development.