CVE-2026-58643

Received Received - Intake

Cross-Site Scripting in Windows Admin Center

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: Microsoft Corporation

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-16

Generated

2026-07-17

AI Q&A

2026-07-17

EPSS Evaluated

N/A

NVD

CVE-2026-58643

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_admin_center	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Windows Admin Center. It occurs when user input is not properly neutralized during web page generation, allowing an attacker to inject malicious scripts. These scripts can then be executed in the context of another user's session, potentially leading to spoofing attacks over the network.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to malicious sites, or perform actions on behalf of users without their consent. This may result in unauthorized access to sensitive data or system controls, depending on the privileges of the affected user.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Apply the latest security updates from Microsoft for Windows Admin Center immediately to patch the XSS vulnerability. Disable unnecessary web interfaces if not in use and monitor network traffic for suspicious activity related to spoofing attempts.

Hi! I’m here to help you understand CVE-2026-58643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70