Microsoft has disclosed a high-severity privilege escalation vulnerability, CVE-2026-26119, in its Windows Admin Center (WAC) platform. While assigned a CVSS score of 8.8, Microsoft internally assesses the risk as critical due to the potential for full system or domain compromise.

Key Details of CVE-2026-26119

• Vulnerability Type: Improper authentication (CWE-287).
• Impact: An authorized attacker with limited privileges can elevate their rights to those of the user running the Windows Admin Center application. Since WAC often runs with elevated administrative permissions, this can grant sweeping control over managed servers, clusters, and infrastructure.
• Exploitation Status: Microsoft states that while no public exploits are currently known, exploitation is considered “more likely” in the near future.
• Discovery: The flaw was discovered by researcher Andrea Pierini of Semperis in July 2025.

Recommended Actions

• Immediate Update: Microsoft released a patch for this issue in Windows Admin Center version 2511 (released in December 2025). Administrators should ensure they are running this version or later.
• Restrict Access: Use the Microsoft Security Response Center (MSRC) Guide to verify your current version and follow official mitigation steps, such as implementing strict network segmentation for management tools.
• Monitor Logs: Look for unusual privilege escalation attempts or anomalous access patterns within your Windows Admin Center environment.