Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center

Summary: Microsoft disclosed a patched high-severity flaw in Windows Admin Center, tracked as CVE-2026-26119 with a CVSS score of 8.8, caused by improper authentication that lets an authorized attacker elevate privileges over a network to the rights of the user running the affected application. Microsoft credited Semperis researcher Andrea Pierini with the discovery, said the issue was fixed in Windows Admin Center version 2511 released in December 2025, and tagged it 'Exploitation More Likely' while stating no known in-the-wild exploitation.
What's compelling: Pierini said the flaw could allow a full domain compromise starting from a standard user under certain conditions, and Microsoft's 'Exploitation More Likely' tag means the window between disclosure and attack is short for anyone still running an unpatched Windows Admin Center.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-26119
Related: ⚡ Weekly Recap: Double-Tap Skimmers, Prompt Spy AI, 30Tbps DDoS, Docker Malware & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026