Introduction
A missing authorization check in the Windows Admin Center update API gave any low-privileged authenticated user the ability to install arbitrary software versions on the management gateway, including downgrading to older builds with known vulnerabilities. For organizations that rely on Windows Admin Center as their centralized HTML5 portal for managing servers, clusters, and Azure VMs, this flaw (CVE-2026-35438, CVSS 8.3) turned the update mechanism into an attack surface that could undermine the integrity and availability of the entire administrative infrastructure.
Technical Information
Root Cause: Missing Authorization (CWE-862)
The update API endpoint in Windows Admin Center had no authorization check. This endpoint triggers software version installations and modifications, and under normal operation only users with elevated administrative permissions should be able to call it. The vulnerable implementation did not enforce that boundary. Any authenticated user with basic (low privilege) access could use the update API as though they held higher-level permissions.
The weakness is classified under CWE-862 (Missing Authorization), which covers software that does not check whether an actor is authorized before it lets that actor access a resource or perform an action.
Attack Flow
Exploiting CVE-2026-35438 is straightforward:
-
Initial Access: The attacker authenticates to the Windows Admin Center instance over the network with a low-privileged account. No special access conditions or extenuating circumstances are required, and the attack complexity is rated Low.
-
API Request Crafting: The attacker sends a specially crafted request to the Windows Admin Center update API endpoint. Because the endpoint lacks authorization checks, it does not verify whether the requesting user has the privileges to perform update operations.
-
Arbitrary Version Installation: The attacker uses the unprotected API to install any available Windows Admin Center version from the update catalog. That means the attacker can:
- Overwrite the current installation with the same version (disrupting service).
- Downgrade to an older version that contains known, previously patched vulnerabilities.
- Install a different build that alters the behavior of the management gateway.
-
Impact Realization: The integrity impact is High because the attacker can overwrite or alter the existing installation. The availability impact is also High because normal operations can be completely disrupted. The confidentiality impact is rated Low. The exploit does not directly expose sensitive data, but installing an older version with known information disclosure flaws could create indirect exposure.
CVSS Breakdown
The full CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H/E:U/RL:O/RC:C
The metrics break down as follows:
| Metric | Value | Significance |
|---|---|---|
| Attack Vector | Network | Exploitable remotely across one or more network hops |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | Low | Only basic user capabilities needed |
| User Interaction | None | Exploitable solely at the will of the attacker |
| Scope | Unchanged | Impacts only the vulnerable component |
| Integrity Impact | High | Existing installation can be overwritten |
| Availability Impact | High | Normal operations can be completely disrupted |
| Confidentiality Impact | Low | No direct sensitive data exposure |
Network access, low complexity, low privilege requirements, and no user interaction together put this vulnerability within easy reach of any insider, or of anyone holding a compromised account on the network.
Patch Information
Microsoft fixed CVE-2026-35438 in an official security update released on May 12, 2026, as part of the May 2026 Patch Tuesday cycle. The fix ships as a new build, Windows Admin Center version 2.6.5.16, available for download at aka.ms/downloadWAC, with release notes at aka.ms/wac2511.
Version 2.6.5.16 enforces authorization checks on the update API, so only users with the appropriate elevated permissions can trigger version installations or modifications through the Windows Admin Center update path. Once the fix is applied, low-privileged authenticated users can no longer manipulate the software update lifecycle.
Administrators should validate the installation after patching and confirm that Windows Admin Center is running the latest secure version. Because the vulnerability specifically lets attackers install older versions, confirming that low-privileged users can no longer access the update API is a critical step.
Azure Portal variant: A related but distinct vulnerability, CVE-2026-41086, affects Windows Admin Center in Azure Portal. It has its own fix (version 2.6.7), available from a different download location. Organizations running both the on-premises and Azure Portal variants of Windows Admin Center should apply both updates.
The vulnerability was reported by sho odagiri of GMO Cybersecurity by Ierae, Inc.
Affected Systems and Versions
Based on the available advisory data, the affected product is Microsoft Windows Admin Center (on-premises variant), versions prior to 2.6.5.16.
The vulnerability is exploitable in any deployment where Windows Admin Center is reachable over the network and low-privileged users can authenticate to the instance. That covers physical, virtual, on-premises, and hosted environments where Windows Admin Center is deployed as the management gateway.
Organizations that run the Azure Portal variant of Windows Admin Center should also evaluate their exposure to CVE-2026-41086, which requires a separate update to version 2.6.7.
References
- Microsoft Security Response Center Advisory for CVE-2026-35438
- NVD Detail Page for CVE-2026-35438
- Microsoft CVRF for May 2026
- Rapid7 Patch Tuesday Analysis, May 2026
- Windows Admin Center Overview, Microsoft Learn
- Get Started with Windows Admin Center, Microsoft Learn
- Windows Admin Center Download (aka.ms/downloadWAC)
- Windows Admin Center 2511 Release Notes (aka.ms/wac2511)
