Microsoft Patches High-Severity CVE-2026-26119 Privilege Escalation in Windows Admin Center

Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center

Microsoft has addressed a critical improper authentication vulnerability in its browser-based Windows Admin Center management suite. Tracked as CVE-2026-26119, the flaw carries a CVSS score of 8.8 and was disclosed publicly on February 17, 2026.

Why This Matters

While Windows Admin Center is designed to provide secure, cloud-independent management of servers and clusters, improper authentication mechanisms can bypass these isolation boundaries. This vulnerability demonstrates the technical reality where a standard user can potentially achieve full domain compromise, undermining the least-privilege models intended for local infrastructure management tools.

Key Insights

• CVE-2026-26119 carries a high-severity CVSS score of 8.8, indicating a significant risk for network-based privilege escalation.
• The vulnerability was officially patched in Windows Admin Center version 2511, released by Microsoft in December 2025.
• Researcher Andrea Pierini from Semperis discovered the flaw, noting it could allow full domain compromise from a standard user account.
• Microsoft has assigned an ‘Exploitation More Likely’ assessment to this vulnerability despite no current evidence of active exploitation.
• The flaw resides in improper authentication logic, allowing attackers to gain the rights of the user running the affected application.

Practical Applications

• Use Case: Deployment of Windows Admin Center v2511 to manage Windows Clients and Servers without cloud connectivity risks.
• Pitfall: Maintaining legacy versions of Windows Admin Center allows network-based attackers to escalate privileges to the application’s user level.
• Use Case: Validating authentication configurations in local management tools to prevent standard user escalation to domain admin.
• Pitfall: Assuming that local, browser-based tools are immune to network-based attacks, leading to delayed patching of high-CVSS vulnerabilities.

References:

• http://thehackernews.com/2026/02/microsoft-patches-cve-2026-26119.html