CVE-2026-56197: Windows Admin Center RCE Vulnerability

CVE-2026-56197 Overview

CVE-2026-56197 is a command injection vulnerability in Microsoft Windows Admin Center. The flaw stems from improper neutralization of special elements used in a command [CWE-77]. An authenticated attacker can send crafted input over the network to execute arbitrary code on the affected system.

Windows Admin Center is a browser-based management tool used by administrators to manage Windows Servers, clusters, and hyperconverged infrastructure. Exploitation grants an attacker the ability to compromise the integrity, confidentiality, and availability of managed systems.

Critical Impact
An authorized attacker with low privileges can execute arbitrary commands on Windows Admin Center over the network, potentially compromising every server managed through the console.

Affected Products

Microsoft Windows Admin Center

Discovery Timeline

2026-07-14 - CVE-2026-56197 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-56197

Vulnerability Analysis

The vulnerability resides in how Windows Admin Center handles input passed to underlying operating system commands. User-supplied data reaches a command execution context without adequate sanitization or escaping of shell metacharacters. This allows an attacker to inject additional commands that execute in the context of the Windows Admin Center service.

Exploitation requires the attacker to hold valid low-privilege credentials on the Windows Admin Center instance. Because Windows Admin Center typically runs with elevated privileges to perform server management operations, injected commands often run with substantially higher privileges than those held by the attacker. The attack completes over the network with no user interaction, making it suitable for lateral movement inside a compromised enterprise.

Root Cause

The root cause is improper neutralization of special elements used in a command, classified under [CWE-77]. The affected code paths concatenate attacker-controlled parameters into command strings without applying allowlist validation or safe argument passing APIs. Special characters such as &, |, ;, and backticks are not stripped or escaped before the command reaches the interpreter.

Attack Vector

An attacker authenticates to Windows Admin Center with any low-privilege account. The attacker then submits a request to a vulnerable management endpoint, embedding shell metacharacters within a parameter that gets passed to a system command. The injected payload executes on the underlying host, granting arbitrary code execution.

The vulnerability manifests in command construction routines within Windows Admin Center management endpoints. Microsoft has not published exploitation code. Refer to the Microsoft Security Advisory for technical details.

Detection Methods for CVE-2026-56197

Indicators of Compromise

Unexpected child processes spawned by the Windows Admin Center service account, particularly cmd.exe, powershell.exe, or wscript.exe.
Outbound network connections initiated by Windows Admin Center worker processes to unknown external hosts.
HTTP requests to Windows Admin Center management endpoints containing shell metacharacters such as &, |, ;, `, or $(.
New scheduled tasks, services, or local accounts created on the Windows Admin Center gateway host.

Detection Strategies

Monitor process creation events (Windows Event ID 4688 and Sysmon Event ID 1) for suspicious child processes of the Windows Admin Center gateway process.
Inspect Windows Admin Center audit logs for authenticated sessions performing atypical management actions.
Deploy web application firewall rules that inspect POST bodies to Windows Admin Center endpoints for command injection patterns.

Monitoring Recommendations

Baseline normal Windows Admin Center activity per administrator and alert on deviations in command volume or target host count.
Correlate authentication events on the gateway with process creation and outbound network activity to identify session hijacking or credential abuse.
Enable PowerShell script block logging on the Windows Admin Center host to capture any injected script content.

How to Mitigate CVE-2026-56197

Immediate Actions Required

Apply the Microsoft security update for Windows Admin Center referenced in the Microsoft Security Advisory.
Restrict network access to the Windows Admin Center gateway to authorized administrative subnets only.
Audit and reduce the number of accounts granted access to Windows Admin Center, enforcing least privilege.
Rotate credentials for any low-privilege accounts that had access to Windows Admin Center prior to patching.

Patch Information

Microsoft has released a security update for Windows Admin Center. Administrators should consult the Microsoft Security Advisory for the specific update package matching their deployment and apply it without delay.

Workarounds

Isolate the Windows Admin Center gateway behind a jump host or VPN accessible only to trusted administrators.
Enforce multi-factor authentication on all accounts permitted to log in to Windows Admin Center.
Disable Windows Admin Center temporarily if patching cannot be performed within the maintenance window.

bash

# Configuration example: restrict Windows Admin Center access via Windows Firewall
New-NetFirewallRule -DisplayName "WAC-Admin-Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow

# Block all other inbound access to the WAC gateway
New-NetFirewallRule -DisplayName "WAC-Block-Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -Action Block