Technical impact
Missing authorization in Windows Admin Center permits an attacker with existing access to gain higher privileges. The flaw allows the transition from a regular user role to an administrative level, compromising the confidentiality, integrity, and availability of the managed environment. The weakness falls under CWE-862 and can enable unilateral changes to configuration, service startup, or user accounts.
Affected Systems
Affected vendors: Microsoft; product: Windows Admin Center. No specific version ranges are listed in the CNA data, so all installations may be vulnerable until an update is applied.
Risk and Exploitability
The CVSS score of 8.3 marks it as high severity. EPSS is unavailable, and it is not yet listed in CISA's KEV catalog. The likely attack vector is remote, via the network interface used by Windows Admin Center, and requires an attacker to have authenticated access. Once authenticated, exploitation can occur without additional user interaction, raising the risk to significant systems.
