Description
Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.
Published: 2026-07-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A command injection flaw in Windows Admin Center allows an attacker with authorized credentials to run arbitrary system commands over the network. The vulnerability stems from improper neutralization of special elements that are passed to the operating system, leading to a direct loss of confidentiality, integrity, and availability of the host where WAC is installed. The weakness is identified as CWE-77.

Affected Systems

Microsoft Windows Admin Center is affected. No specific version range is listed in the available data, so all installed instances remain potentially vulnerable until patched.

Risk and Exploitability

The CVSS score of 8.8 signals a high severity of the flaw. Its EPSS score is below 1 %, indicating that public exploitation is considered unlikely at this time, and it is not currently listed in the CISA KEV catalog. Nonetheless, the flaw permits code execution for anyone who can authenticate to the WAC service, and the attack vector is inferred to be network‑based with requirements for authorized access.

Generated by OpenCVE AI on July 31, 2026 at 06:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Windows Admin Center update provided by Microsoft to remove the command injection flaw.
  • Isolate the Windows Admin Center infrastructure from untrusted networks and enforce strict network segmentation to limit exposure.
  • Restrict administrative access to Windows Admin Center to trusted users only, require multi‑factor authentication, and regularly review audit logs for suspicious activity.

Generated by OpenCVE AI on July 31, 2026 at 06:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.
Title Windows Admin Center (WAC) Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows Admin Center
Weaknesses CWE-77
CPEs cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows Admin Center
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows Admin Center
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-30T20:27:02.163Z

Reserved: 2026-06-19T13:54:04.007Z

Link: CVE-2026-56197

cve-icon Vulnrichment

Updated: 2026-07-14T17:55:10.905Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T06:30:18Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')