CVE-2026-32196
Cross-Site Scripting in Windows Admin Center Enables Network Spoofing
Publication date: 2026-04-14
Last updated on: 2026-04-28
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | windows_admin_center | to 2511 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a type of cross-site scripting (XSS) found in Windows Admin Center. It occurs because the software does not properly neutralize input during web page generation. This flaw allows an unauthorized attacker to perform spoofing attacks over a network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthorized attacker to perform spoofing over a network via cross-site scripting in Windows Admin Center.
Such spoofing attacks can potentially lead to unauthorized access or manipulation of sensitive information, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and sensitive data.
However, the provided information does not explicitly describe the direct effects on compliance with these standards.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to spoof content or impersonate trusted entities over a network. This can lead to unauthorized actions or information disclosure, potentially compromising the integrity and confidentiality of data accessed through Windows Admin Center.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Windows Admin Center is updated with the latest security patches provided by Microsoft.
Since the vulnerability involves improper neutralization of input leading to cross-site scripting and spoofing, avoid interacting with suspicious web pages or inputs within the Windows Admin Center until patched.