Loading story…
Researchers disclosed multiple vulnerabilities in Microsoft Windows Admin Center (WAC) that could let attackers compromise hybrid environments spanning Azure and on-premises infrastructure. Cymulate said one exploit chain enabled unauthenticated, one-click remote code execution when a victim visited a malicious URL, combining response-based cross-site scripting, insecure redirect handling, and insecure credential storage to steal credentials, run arbitrary PowerShell commands, and capture Azure tokens. The issues affected both Azure-integrated and on-prem deployments, with the most severe risk falling on self-managed on-prem WAC instances that could be used to execute commands on managed servers and pivot into cloud resources.
Additional flaws presented at Black Hat Asia were tracked as CVE-2025-64669, CVE-2026-20965, CVE-2026-23660, and CVE-2026-32196, including a non-write-protected on-prem WAC directory and weaknesses in proof-of-possession token validation that could allow token reuse or forgery and takeover of tenant VMs. Microsoft said Azure-managed instances received server-side fixes after responsible disclosure, and the company has patched the broader set of vulnerabilities with no evidence of active exploitation. Researchers urged organizations to update on-prem WAC immediately, remove outdated exposed instances, and treat both cloud and on-prem management planes as tier-zero assets because WAC can serve as a bidirectional path between the two environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
At Black Hat Asia, Cymulate researchers publicly disclosed the Windows Admin Center vulnerabilities and described how they could enable one-click unauthenticated RCE, credential theft, token abuse, and movement between on-premises and Azure environments. They warned that on-premises deployments were especially exposed and urged organizations to update and verify no outdated instances remained accessible.
Microsoft patched four vulnerabilities affecting Windows Admin Center in hybrid Azure and on-premises environments, including CVE-2025-64669, CVE-2026-20965, CVE-2026-23660, and CVE-2026-32196. Reporting states there was no indication of active exploitation at the time of disclosure.
After the responsible disclosure, Microsoft deployed server-side mitigations for Azure-managed Windows Admin Center instances, automatically protecting cloud customers. The fixes addressed the Azure side of the disclosed attack chain.
Cymulate Research Labs reported a critical Windows Admin Center vulnerability chain to Microsoft under responsible disclosure. The disclosure date is explicitly given as August 22, 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched a **critical elevation-of-privilege vulnerability** in *Windows Admin Center (WAC)* tracked as **CVE-2026-26119**. The issue is caused by **improper authentication** (`CWE-287`) and is rated **CVSS 8.8** with a network attack vector (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). An attacker with **low/limited existing privileges** could exploit the flaw over the network to gain elevated privileges equivalent to the user context running WAC, which is particularly high impact given WAC’s role in centralized administration of Windows servers. Microsoft’s advisory indicates the vulnerability was newly published in its Security Update Guide and is addressed via an **official Windows Admin Center security update**; organizations are advised to apply the update promptly. Public reporting also notes Microsoft has **not observed active exploitation** at the time of disclosure, but assesses exploitation as **more likely** due to low attack complexity and typical enterprise exposure of WAC deployments; no public PoC was noted. Microsoft credited **Andrea Pierini (Semperis)** for responsible disclosure.
Jun 29, 2026
A critical vulnerability in the JumpCloud Remote Assist for Windows agent (CVE-2025-34352) allows a standard user on a company-managed device to gain full, persistent SYSTEM-level control. The flaw, discovered by XM Cyber, arises from the agent's uninstallation process, which performs privileged file operations in a user-controlled temporary folder. This enables local users to exploit the uninstall routine to overwrite or delete sensitive system files, resulting in either local privilege escalation or denial of service. Over 180,000 organizations using JumpCloud are potentially at risk until the issue is remediated. Separately, Microsoft’s Windows Admin Center (WAC) is affected by a local privilege escalation vulnerability (CVE-2025-64669) due to insecure directory permissions on `C:\ProgramData\WindowsAdminCenter`. Standard users can write to this directory, which is also accessed by services running with elevated privileges, allowing attackers to exploit extension uninstall mechanisms or DLL hijacking to obtain SYSTEM-level access. Both vulnerabilities highlight the risks posed by improper privilege separation and insecure file system permissions in widely deployed Windows management tools.
Jun 29, 2026
Microsoft published security advisories for two **Elevation of Privilege** flaws affecting Windows components: `CVE-2026-23660` in **Windows Admin Center in Azure Portal** and `CVE-2025-62472` in **Windows Remote Access Connection Manager**. Both entries were released through Microsoft's Security Update Guide, identifying separate privilege-escalation issues in enterprise-relevant Windows management and connectivity functionality. The disclosures indicate that attackers who successfully exploit the vulnerabilities could gain higher privileges on affected systems, increasing the risk of broader compromise after initial access. Organizations using Windows administrative tooling in Azure environments and systems relying on Remote Access Connection Manager should review Microsoft's advisories, determine exposure to the affected components, and prioritize applicable security updates and mitigation steps.
Jul 9, 2026