CVE-2026-20965CWE-347

Windows Admin Center Elevation of Privilege Vulnerability

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can exploit a signature verification flaw to elevate their privileges locally in Windows Admin Center — talk about a backdoor invite! 🔓 This is like finding a VIP pass to a concert that lets you backstage without anyone checking your ID — the gatekeeper should have verified it, but they skipped the step! An attacker could gain elevated privileges, allowing them to modify settings, access sensitive data, or even compromise the entire system. This could lead to devastating consequences, including potential data leaks and system breaches if left unchecked!

Put simply

This is like finding a VIP pass to a concert that lets you backstage without anyone checking your ID — the gatekeeper should have verified it, but they skipped the step! The vulnerability arises due to improper verification of cryptographic signatures in Windows Admin Center, enabling an attacker with valid credentials to elevate their permissions without adequate checks.

What to do

An attacker could gain elevated privileges, allowing them to modify settings, access sensitive data, or even compromise the entire system. This could lead to devastating consequences, including potential data leaks and system breaches if left unchecked! Immediately patch Windows Admin Center to the latest version to close this loophole. Review your access controls and ensure that all administrative privileges are granted wisely, as a precaution against future threats. You've got this! By taking these steps, you'll be well on your way to locking down your system and keeping the bad guys out! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Admin Center Elevation of Privilege Vulnerability
    cvelistv5