Executive brief
A security vulnerability in the Windows Admin Center within the Azure Portal could allow a user who already has limited access to a system to gain higher-level administrative privileges. This tool is used by IT administrators to manage Windows servers and virtual machines remotely. If exploited, an attacker could gain full control over the affected management environment, potentially leading to unauthorized data access or service disruption.
Technical details
A privilege escalation vulnerability (CWE-59) exists in the Azure Portal Windows Admin Center due to improper link resolution before file access, commonly known as a 'link following' or symlink attack. An attacker with local access and low-level privileges can exploit this flaw by creating symbolic links or junctions that redirect file operations performed by a higher-privileged process to a target file of the attacker's choosing. Successful exploitation allows the attacker to gain elevated system privileges, achieving full confidentiality, integrity, and availability impact on the local host. The vulnerability is tracked as CVE-2026-42834 and was disclosed by Microsoft.
Affected products
- Microsoft Windows Admin Center in Azure Portal
Timeline
- 2026-05-20: advisory: Initial disclosure by Microsoft and NVD publication.