CVE-2026-23660: Microsoft Windows Admin Center

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Windows Admin Center: before 2.6.4 (fixed in 2.6.4)

Published 2026-03-10. Last modified 2026-06-17.