Windows Admin Center contains an improper verification of cryptographic signatures, which allows an attacker with existing local authorization to elevate their privileges on the affected system. The flaw can be exploited by providing a maliciously signed component that bypasses the intended integrity check, granting the attacker higher permissions without valid endorsement.

Microsoft Windows Admin Center deployed through the Azure Portal is affected. Specific versions are not listed, so all installations of Windows Admin Center should be reviewed for the presence of the vulnerability until a patch is applied.

The vulnerability has a CVSS score of 7.5, indicating a high severity level of privilege escalation. The EPSS score is below 1%, suggesting a low exploitation probability at this time. It is not in the CISA KEV catalog. The likely attack vector requires that the attacker already has local authorized access to the machine running Windows Admin Center, which limits the scope but still poses a serious threat in environments where local admin rights are lax or shared.