PT-2026-32848 · Microsoft · Windows Admin Center

Ben Zamir + 3 · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-32196

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Windows Admin Center (affected versions not specified)

Description Improper neutralization of input during web page generation leads to cross-site scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites. An unauthorized attacker can craft a malicious gateway URL that triggers a response-based XSS within the error handling of the software. When visited by a privileged Azure administrator, this allows JavaScript execution under the software origin. This can lead to arbitrary PowerShell execution on every managed server the victim has access to without requiring credentials. In on-premises deployments, this chain enables the theft of Azure access and refresh tokens from local storage, allowing for full tenant impersonation and lateral movement into EntraID and Azure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32196

Affected Products

Windows Admin Center

References · 5

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32196 · Security Note
• https://twitter.com/UndercodeUpdate/status/2044426945782272185 · Twitter Post
• https://twitter.com/RubenLabs/status/2044363880067940723 · Twitter Post
• https://twitter.com/CVEnew/status/2044358572880867347 · Twitter Post