CVE-2025-29819: Windows Admin Center Information Disclosure

CVE-2025-29819 Overview

CVE-2025-29819 is an information disclosure vulnerability in Microsoft Windows Admin Center in the Azure Portal. The flaw stems from external control of a file name or path [CWE-73], allowing a local attacker to read sensitive files. The vulnerability requires no privileges and no user interaction, but the attack vector is local. Successful exploitation results in high-impact disclosure of confidential data without affecting integrity or availability. Microsoft published the advisory on April 8, 2025.

Critical Impact
A local, unauthenticated attacker can influence file paths processed by Windows Admin Center to disclose sensitive information stored on the host.

Affected Products

Microsoft Windows Admin Center
Microsoft Windows Admin Center in Azure Portal
Windows Admin Center deployments managing Azure and on-premises servers

Discovery Timeline

2025-04-08 - CVE-2025-29819 published to the National Vulnerability Database
2025-04-08 - Microsoft releases advisory for CVE-2025-29819
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29819

Vulnerability Analysis

CVE-2025-29819 is classified under [CWE-73: External Control of File Name or Path]. Windows Admin Center accepts input that influences a file path used in a subsequent file operation. Because the application does not sufficiently constrain the resolved path, an attacker with local access to the host can direct the tool to read files outside the intended scope. The vulnerability affects confidentiality only; integrity and availability remain unaffected.

Root Cause

The root cause is improper validation and canonicalization of a user-influenced file identifier inside Windows Admin Center. The application trusts input that should be treated as untrusted, then uses it directly in a file access routine. Attackers can leverage this behavior to reference arbitrary files readable by the Windows Admin Center process context.

Attack Vector

The attack requires local access to the system where Windows Admin Center is installed. An attacker submits a crafted file name or path through an interface accepted by the tool. The application resolves that value and reads the referenced content, returning data to the attacker. No authentication is required to reach the vulnerable code path. See the Microsoft CVE-2025-29819 Advisory for vendor-supplied technical detail.

No public proof-of-concept code is available for this vulnerability. The mechanism is described in prose above; refer to the vendor advisory for authoritative technical guidance.

Detection Methods for CVE-2025-29819

Indicators of Compromise

Windows Admin Center process accessing files outside its normal working directories, such as user profile folders, credential stores, or system configuration files.
Unexpected reads of sensitive files (for example, web.config, private keys, or .pfx files) correlated with Windows Admin Center activity.
Anomalous local process activity around the Windows Admin Center service account.

Detection Strategies

Enable Windows file system auditing on sensitive directories and alert on read events initiated by the Windows Admin Center service process.
Correlate Windows Admin Center application logs with Sysmon Event ID 11 (file create) and Event ID 1 (process create) to identify unusual file path parameters.
Baseline the file paths Windows Admin Center legitimately accesses and alert on deviations.

Monitoring Recommendations

Ship Windows Admin Center host telemetry, including process, file, and authentication events, into a centralized analytics platform for behavioral analysis.
Monitor local logon events on Windows Admin Center gateway hosts, since the vulnerability requires local access.
Track patch state of Windows Admin Center gateways as a continuous configuration check.

How to Mitigate CVE-2025-29819

Immediate Actions Required

Apply the Microsoft-supplied update for Windows Admin Center referenced in the Microsoft CVE-2025-29819 Advisory.
Inventory all Windows Admin Center gateways, including Azure Portal integrations, and confirm each is running a fixed build.
Restrict local interactive and remote desktop access to Windows Admin Center hosts to a small set of trusted administrators.

Patch Information

Microsoft has issued a security update for Windows Admin Center that resolves the external file path control issue. Administrators should install the update on all gateway servers hosting Windows Admin Center and on any Azure-connected instances. Refer to the Microsoft CVE-2025-29819 Advisory for the specific fixed version and download instructions.

Workarounds

Limit console and remote session access to Windows Admin Center gateway hosts using Group Policy and privileged access workstation practices.
Enforce least-privilege on the Windows Admin Center service account so it cannot read sensitive files outside its required scope.
Segment Windows Admin Center gateways from general-purpose user workstations to reduce local attacker exposure.

bash

# Configuration example: verify installed Windows Admin Center version on a gateway host
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\ServerManagementGateway' |
    Select-Object -Property Version, InstallDir

# Restrict interactive logon to administrators only via local security policy
secedit /export /cfg C:\secpol.cfg
# Edit SeInteractiveLogonRight to include only trusted admin groups, then reapply:
secedit /configure /db secedit.sdb /cfg C:\secpol.cfg /areas USER_RIGHTS