Loading story…
Microsoft disclosed and patched a critical elevation-of-privilege vulnerability in Windows Admin Center (WAC) tracked as CVE-2026-26119. The issue is caused by improper authentication (CWE-287) and is rated CVSS 8.8 with a network attack vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with low/limited existing privileges could exploit the flaw over the network to gain elevated privileges equivalent to the user context running WAC, which is particularly high impact given WAC’s role in centralized administration of Windows servers.
Microsoft’s advisory indicates the vulnerability was newly published in its Security Update Guide and is addressed via an official Windows Admin Center security update; organizations are advised to apply the update promptly. Public reporting also notes Microsoft has not observed active exploitation at the time of disclosure, but assesses exploitation as more likely due to low attack complexity and typical enterprise exposure of WAC deployments; no public PoC was noted. Microsoft credited Andrea Pierini (Semperis) for responsible disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On the same day as public disclosure, Microsoft released security update guidance highlighting that the flaw affects Windows Admin Center 2.6.4 and urging administrators to apply the available update. Public reporting noted the vulnerability's CVSS 8.8 severity and potential for broad administrative impact in enterprise environments.
Microsoft publicly acknowledged CVE-2026-26119 in its Security Update Guide, describing it as a high-severity Windows Admin Center elevation-of-privilege vulnerability. Microsoft rated exploitation as more likely and reported no evidence of active exploitation at disclosure time.
Microsoft addressed CVE-2026-26119 in Windows Admin Center version 2511, released in early December 2025. The fix remediated the improper authentication issue affecting Windows Admin Center deployments.
Andrea Pierini of Semperis discovered the improper authentication vulnerability in Windows Admin Center later assigned CVE-2026-26119. The flaw could allow an already authorized low-privilege user to elevate privileges over the network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethecyberthrone.in
Open sourcethehackernews.com
Open sourcetechrepublic.com
Open sourcehelpnetsecurity.com
Open sourcecyberpress.org
Open sourcecybersecuritynews.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for two **Elevation of Privilege** flaws affecting Windows components: `CVE-2026-23660` in **Windows Admin Center in Azure Portal** and `CVE-2025-62472` in **Windows Remote Access Connection Manager**. Both entries were released through Microsoft's Security Update Guide, identifying separate privilege-escalation issues in enterprise-relevant Windows management and connectivity functionality. The disclosures indicate that attackers who successfully exploit the vulnerabilities could gain higher privileges on affected systems, increasing the risk of broader compromise after initial access. Organizations using Windows administrative tooling in Azure environments and systems relying on Remote Access Connection Manager should review Microsoft's advisories, determine exposure to the affected components, and prioritize applicable security updates and mitigation steps.
Jul 9, 2026
Researchers disclosed multiple vulnerabilities in Microsoft **Windows Admin Center (WAC)** that could let attackers compromise hybrid environments spanning **Azure** and on-premises infrastructure. Cymulate said one exploit chain enabled **unauthenticated, one-click remote code execution** when a victim visited a malicious URL, combining response-based cross-site scripting, insecure redirect handling, and insecure credential storage to steal credentials, run arbitrary **PowerShell** commands, and capture Azure tokens. The issues affected both Azure-integrated and on-prem deployments, with the most severe risk falling on self-managed on-prem WAC instances that could be used to execute commands on managed servers and pivot into cloud resources. Additional flaws presented at Black Hat Asia were tracked as **`CVE-2025-64669`**, **`CVE-2026-20965`**, **`CVE-2026-23660`**, and **`CVE-2026-32196`**, including a non-write-protected on-prem WAC directory and weaknesses in proof-of-possession token validation that could allow token reuse or forgery and takeover of tenant VMs. Microsoft said Azure-managed instances received server-side fixes after responsible disclosure, and the company has patched the broader set of vulnerabilities with no evidence of active exploitation. Researchers urged organizations to update on-prem WAC immediately, remove outdated exposed instances, and treat both cloud and on-prem management planes as **tier-zero assets** because WAC can serve as a bidirectional path between the two environments.
Jun 29, 2026
Microsoft published details for **CVE-2026-26132**, an **Important** severity **Windows Kernel** *elevation of privilege* vulnerability caused by **CWE-416 (use-after-free)**. The issue is scored **CVSS 3.1: 7.8** with vector `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating exploitation requires **local access** and **low complexity**, with **low privileges required** and **no user interaction**, and could result in high impact to confidentiality, integrity, and availability. Microsoft’s Security Update Guide entry provides standard machine-consumable references (e.g., *PowerShell*, *API*, and *CSAF* links) for tracking and patch management. No additional exploitation details, in-the-wild exploitation confirmation, or public proof-of-concept information is included in the provided material beyond the vulnerability classification and scoring.
Jul 9, 2026