Introduction
A missing authorization check in the Windows Admin Center update API quietly gave any low privileged authenticated user the ability to install arbitrary software versions on the management gateway, including downgrading to older builds carrying known vulnerabilities. For organizations that rely on Windows Admin Center as their centralized HTML5 portal for managing servers, clusters, and Azure VMs, this flaw (CVE-2026-35438, CVSS 8.3) turned the update mechanism itself into an attack surface that could undermine the integrity and availability of the entire administrative infrastructure.
Technical Information
Root Cause: Missing Authorization (CWE-862)
The core issue is a missing authorization check on the update API endpoint within Windows Admin Center. This endpoint is responsible for triggering software version installations and modifications. Under normal operation, only users with elevated administrative permissions should be able to invoke this functionality. However, the vulnerable implementation failed to enforce that authorization boundary, meaning any authenticated user with basic (low privilege) access could interact with the update API as though they held higher level permissions.
This weakness is classified under CWE-862 (Missing Authorization), which describes scenarios where software does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack Flow
The exploitation path for CVE-2026-35438 follows a straightforward sequence:
-
Initial Access: The attacker authenticates to the Windows Admin Center instance over the network using a low privileged account. No special access conditions or extenuating circumstances are required; the attack complexity is rated Low.
-
API Request Crafting: The attacker sends a specially crafted request to the Windows Admin Center update API endpoint. Because the endpoint lacks proper authorization checks, it does not verify whether the requesting user has sufficient privileges to perform update operations.
-
Arbitrary Version Installation: The attacker leverages the unprotected API to install any available Windows Admin Center version from the update catalog. This includes the ability to:
- Overwrite the current installation with the same version (disrupting service).
- Downgrade to an older version that contains known, previously patched vulnerabilities.
- Install a different build that alters the behavior of the management gateway.
-
Impact Realization: The integrity impact is High because the attacker can overwrite or alter the existing installation. The availability impact is also High because normal operations can be completely disrupted. Confidentiality impact is rated Low; while the exploit does not directly expose sensitive data, installing an older version with known information disclosure flaws could create indirect exposure.
CVSS Breakdown
The full CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H/E:U/RL:O/RC:C
Key observations from the metrics:
| Metric | Value | Significance |
|---|---|---|
| Attack Vector | Network | Exploitable remotely across one or more network hops |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | Low | Only basic user capabilities needed |
| User Interaction | None | Exploitable solely at the will of the attacker |
| Scope | Unchanged | Impacts only the vulnerable component |
| Integrity Impact | High | Existing installation can be overwritten |
| Availability Impact | High | Normal operations can be completely disrupted |
| Confidentiality Impact | Low | No direct sensitive data exposure |
The combination of network accessibility, low complexity, low privilege requirements, and no user interaction makes this vulnerability particularly accessible to any insider or compromised account holder on the network.
Patch Information
Microsoft addressed CVE-2026-35438 with an official security update released on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The fix is delivered as a new build of Windows Admin Center version 2.6.5.16, available for download at aka.ms/downloadWAC, with accompanying release notes at aka.ms/wac2511.
The patch in version 2.6.5.16 enforces proper authorization checks on the update API, ensuring that only users with the appropriate elevated permissions can trigger version installations or modifications through the Windows Admin Center update path. After the fix is applied, low privileged authenticated users can no longer manipulate the software update lifecycle.
Post update validation is important here. Administrators should verify that the Windows Admin Center installation is running the latest secure version after patching. Because the vulnerability specifically allows attackers to install older versions, confirming that low privileged users can no longer access the update API is a critical validation step.
A note on the Azure Portal variant: A related but distinct companion vulnerability, CVE-2026-41086, affects Windows Admin Center in Azure Portal and has its own separate fix (version 2.6.7), available at a different download location. Organizations running both on premises and Azure Portal variants of Windows Admin Center should ensure they apply both updates.
The vulnerability was reported by sho odagiri of GMO Cybersecurity by Ierae, Inc.
Affected Systems and Versions
Based on the available advisory data, the affected product is:
- Microsoft Windows Admin Center (on premises variant), versions prior to 2.6.5.16
The vulnerability is exploitable in any deployment where Windows Admin Center is accessible over the network and low privileged users can authenticate to the instance. This includes physical, virtual, on premises, and hosted environments where Windows Admin Center is deployed as the management gateway.
Organizations should also evaluate their exposure to CVE-2026-41086 if they run the Azure Portal variant of Windows Admin Center, which requires a separate update to version 2.6.7.
References
- Microsoft Security Response Center Advisory for CVE-2026-35438
- NVD Detail Page for CVE-2026-35438
- Microsoft CVRF for May 2026
- Rapid7 Patch Tuesday Analysis, May 2026
- Windows Admin Center Overview, Microsoft Learn
- Get Started with Windows Admin Center, Microsoft Learn
- Windows Admin Center Download (aka.ms/downloadWAC)
- Windows Admin Center 2511 Release Notes (aka.ms/wac2511)
