Microsoft Windows Admin Center: Elevation of privilege
Summary
Windows Admin Center (WAC) versions from 1809.0 before 2.1.36, according to the CNA record, are affected by an elevation of privilege vulnerability. An attacker with a low-privileged authenticated account on the network and some user interaction can gain higher privileges, with potentially high impact on confidentiality, integrity and availability. The CVE description refers to improper authorization, but the record lists CWE-78 (OS command injection), and the vendor has not yet explained the mechanism. The fixed version needs confirmation from MSRC.
Affected
- Windows Admin Center from 1809.0 before 2.1.36, according to the CNA record (version not verified)
Fixed in
Unknown. The CVE record references 2.1.36, but this could not be verified against the MSRC advisory. Check the MSRC advisory for the fixed build.
Workaround
Unknown. No documented workaround found. Patching is the expected fix.
Exploitation
- No evidence of active exploitation found.
- Listed as not in KEV by a third-party aggregator only; not confirmed by CISA.
- CVSS temporal vector E:U (exploit code maturity unproven).
- No public proof of concept found.
Our recommendation
- Update Windows Admin Center to the fixed version as soon as MSRC confirms it.
- Check whether WAC is installed and which version is running.
- Do not expose WAC to the internet and restrict who can sign in to the gateway.
- Apply least privilege to WAC accounts and review administrator access.
- Monitor WAC hosts for unusual privilege changes or logins.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC) msrc.microsoft.com
- CVE Record CVE-2026-122988 www.cve.org
- Strix CVE-2026-122988 www.strix.ai
- TechRepublic: Windows Admin Center privilege escalation www.techrepublic.com
- Microsoft Windows Admin Center download and updates aka.ms
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:51.
Original description (NVD)
Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.