The vulnerability is an authentication bypass that lets a user who has already connected to Windows Admin Center gain higher privileges than intended. The flaw is a lack of proper authority checks (CWE‑287) and can allow an attacker to take control over the management workload, potentially modifying configurations or accessing sensitive data. The impact remains within the scope of the system that hosts Windows Admin Center and does not directly expose remote code execution or denial of service.

Microsoft Windows Admin Center is affected. No specific product releases or version numbers are listed in the advisory, so all deployments of Windows Admin Center are considered at risk until a patch is applied.

The CVSS score of 8.8 indicates high severity. EPSS is less than 1%, suggesting low current exploitation probability but still possible. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need authenticated access to the Windows Admin Center portal and could use the flaw to elevate privileges over the network. No complex prerequisites beyond basic authorization are mentioned, implying the risk is significant for any organization running the product on an open or poorly segmented network.