CVE-2026-42834: Windows Admin Center Privilege Escalation

CVE-2026-42834 Overview

CVE-2026-42834 is a local privilege escalation vulnerability in Microsoft Windows Admin Center for the Azure Portal. The flaw stems from improper link resolution before file access, classified as [CWE-59] link following. An authorized local attacker can abuse symbolic or hard links to redirect privileged file operations to attacker-controlled targets. Successful exploitation grants the attacker elevated privileges on the affected host.

Critical Impact

A locally authenticated attacker can escalate to higher privileges by exploiting link following in Windows Admin Center, gaining full confidentiality, integrity, and availability impact on the target system.

Affected Products

• Microsoft Windows Admin Center (Azure Portal integration)
• CPE: cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:azure:*:*
• Component: microsoft:windows_admin_center

Discovery Timeline

• 2026-05-20 - CVE-2026-42834 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-42834

Vulnerability Analysis

The vulnerability resides in how Windows Admin Center resolves file paths before performing privileged file operations. When the service accesses a file, it fails to validate whether the path contains a symbolic link, junction, or hard link. An attacker with local access can plant a crafted link in a location the privileged process touches. The service then follows the link and operates on a target file the attacker could not normally modify.

This class of bug, tracked as [CWE-59] improper link resolution before file access, is a recurring pattern in Windows services that perform file I/O under elevated tokens. The attack requires local access and low privileges, but no user interaction. Successful exploitation yields high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is missing validation of link targets in the file access path used by Windows Admin Center. The service does not enforce checks such as opening files with FILE_FLAG_OPEN_REPARSE_POINT or verifying that the final resolved path resides in an expected directory. As a result, reparse points planted by a low-privileged user redirect privileged writes or reads to sensitive locations.

Attack Vector

The attack vector is local. A signed-in attacker creates a symbolic link, NTFS junction, or hard link in a directory that Windows Admin Center writes to or reads from during normal operation. When the privileged Windows Admin Center process performs the file action, it follows the planted link and writes attacker-controlled data into a protected file, overwrites a system binary, or alters a configuration that grants elevated execution. The result is local privilege escalation from a standard user context to a higher privilege level on the host.

No verified public proof-of-concept code is available for CVE-2026-42834. Refer to the Microsoft Security Update CVE-2026-42834 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-42834

Indicators of Compromise

• Creation of symbolic links, junctions, or hard links by non-administrative users inside directories used by Windows Admin Center.
• Unexpected file modifications in protected system paths performed by the Windows Admin Center service account.
• New or modified reparse points detected on hosts running Windows Admin Center shortly before privilege changes occur.

Detection Strategies

• Monitor file system events for mklink, CreateSymbolicLink, and DeviceIoControl calls with FSCTL_SET_REPARSE_POINT originating from non-admin processes.
• Audit Windows Admin Center working directories for write operations whose final resolved path differs from the originally requested path.
• Correlate local logon events with subsequent privileged file writes by the Windows Admin Center service to identify suspicious chains.

Monitoring Recommendations

• Enable Windows object access auditing on directories used by Windows Admin Center and on sensitive system folders.
• Alert on token elevation events (Event ID 4672) tied to accounts that previously held only standard user rights.
• Track installation state and version of Windows Admin Center across managed endpoints to confirm patch coverage.

How to Mitigate CVE-2026-42834

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-42834 advisory to all hosts running Windows Admin Center.
• Restrict interactive and remote logon rights on systems hosting Windows Admin Center to administrators only.
• Audit local accounts on Windows Admin Center servers and remove unnecessary standard user access.

Patch Information

Microsoft has published a security update addressing CVE-2026-42834. Administrators should consult the Microsoft Security Update CVE-2026-42834 guide for the specific fixed build of Windows Admin Center applicable to their deployment and apply it through standard update channels.

Workarounds

• Limit local logon to the Windows Admin Center host to trusted administrators until the patch is deployed.
• Disable or uninstall Windows Admin Center on systems where it is not actively required.
• Apply strict NTFS permissions on directories used by Windows Admin Center to prevent link creation by non-privileged users.

# Configuration example: restrict symbolic link creation to administrators
# Remove SeCreateSymbolicLinkPrivilege from standard users via secpol.msc
# or via Group Policy:
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > User Rights Assignment > Create symbolic links
#
# Verify current assignment:
whoami /priv | findstr SeCreateSymbolicLinkPrivilege