A cross‑site scripting vulnerability in Windows Admin Center allows an attacker to inject malicious scripts into generated web pages. This flaw can be used to create spoofed content on the console, tricking users into believing they are interacting with legitimate elements. The attack could compromise the integrity of the user interface and facilitate phishing or credential theft.

The affected product is Microsoft Windows Admin Center. No specific version ranges are provided in the advisory, so all installations should be reviewed for applicable patches.

The CVSS score of 6.1 indicates a moderate severity. Because the vulnerability is a web‑based XSS, the likely attack vector is over the network via the Windows Admin Center web interface; any user with access to the console could craft a payload. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet.