CVE-2026-57107: Windows Admin Center Privilege Escalation

CVE-2026-57107 Overview

CVE-2026-57107 is an improper authentication vulnerability [CWE-287] in Microsoft Windows Admin Center. An authorized local attacker can exploit the flaw to elevate privileges on an affected host. The issue carries a CVSS 3.1 base score of 7.8 and is rated HIGH severity. Successful exploitation impacts confidentiality, integrity, and availability. The attack vector is local, requires low complexity, and needs low-privileged authentication with no user interaction. Microsoft published guidance in the Microsoft Security Response Center (MSRC) update guide. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
An authenticated local attacker can bypass authentication controls in Windows Admin Center to gain elevated privileges, potentially leading to full compromise of the managed host.

Affected Products

Microsoft Windows Admin Center (see the Microsoft Security Update CVE-2026-57107 advisory for specific affected builds)
Windows Server instances managed through Windows Admin Center
Windows client endpoints running the Windows Admin Center gateway

Discovery Timeline

2026-07-14 - CVE-2026-57107 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-57107

Vulnerability Analysis

CVE-2026-57107 stems from improper authentication logic within Windows Admin Center. Windows Admin Center is a browser-based management tool that runs a local gateway service to administer Windows Server and Windows client systems. The vulnerability allows an attacker who already holds low-privileged credentials on the host to bypass authentication checks. After the bypass, the attacker executes actions in the context of a higher-privileged user. Because Windows Admin Center commonly runs with SYSTEM or administrator-equivalent rights when performing management tasks, the resulting privilege escalation grants broad control over the host.

Root Cause

The root cause is classified under [CWE-287] Improper Authentication. Authentication logic in Windows Admin Center fails to correctly validate the identity or privilege boundary of the caller before performing privileged operations. Microsoft has not publicly disclosed the specific code path affected. Refer to the Microsoft Security Update CVE-2026-57107 advisory for vendor-provided technical detail.

Attack Vector

Exploitation requires local access to a host running the Windows Admin Center gateway. The attacker must possess valid low-privileged credentials on that host. No user interaction is required. Once authenticated at the low privilege tier, the attacker triggers the flawed authentication path to reach management functionality reserved for administrators. This can lead to arbitrary command execution, configuration changes, or credential access at an elevated privilege level.

No public exploit code is available. See the vendor advisory linked above for authoritative remediation detail.

Detection Methods for CVE-2026-57107

Indicators of Compromise

Unexpected privileged process creation spawned from the Windows Admin Center gateway service or its associated worker processes.
Creation of new local administrator accounts or additions to privileged groups shortly after Windows Admin Center session activity from non-administrative users.
Anomalous authentication events in the Security event log where a standard user session correlates with privileged Windows Admin Center actions.

Detection Strategies

Correlate Windows Admin Center gateway logs with Windows Security event IDs 4624, 4672, and 4688 to identify privilege transitions tied to non-administrative logons.
Baseline normal administrative activity on Windows Admin Center hosts and alert on privileged actions initiated from unexpected user contexts.
Monitor endpoint telemetry for child processes of the Windows Admin Center service executing sensitive commands such as net localgroup administrators, whoami /priv, or LSASS access.

Monitoring Recommendations

Enable process command-line auditing and forward Windows Admin Center gateway logs to a centralized SIEM.
Track access to the Windows Admin Center management ports (typically TCP 6516) and correlate with local logon sessions.
Alert on installation or modification of Windows Admin Center extensions, which can be leveraged to persist post-escalation.

How to Mitigate CVE-2026-57107

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-57107 advisory to all systems running Windows Admin Center.
Inventory every host running the Windows Admin Center gateway, including jump servers and administrative workstations, and prioritize them for patching.
Restrict interactive and remote logon rights on Windows Admin Center hosts to a minimal set of trusted administrators.

Patch Information

Microsoft has issued a security update through the Microsoft Security Response Center. Refer to the Microsoft Security Update CVE-2026-57107 page for the specific build numbers and download links applicable to your Windows Admin Center deployment. Apply the update through standard Windows update channels or by installing the updated Windows Admin Center MSI package on affected hosts.

Workarounds

Remove or disable Windows Admin Center on hosts where it is not required until the patch can be applied.
Limit local logon rights on Windows Admin Center gateway systems to reduce the pool of accounts that can trigger the flaw.
Enforce multi-factor authentication and just-in-time administration for accounts that manage Windows Admin Center hosts.

bash

# Configuration example: disable the Windows Admin Center gateway service until patched
Stop-Service -Name "ServerManagementGateway"
Set-Service -Name "ServerManagementGateway" -StartupType Disabled