CVE-2026-26119
Published: 17 February 2026
Summary
CVE-2026-26119 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Windows Admin Center. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 48.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26119 is an improper authentication vulnerability in Windows Admin Center that enables privilege escalation. Published on 2026-02-17, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-287 (Improper Authentication). The flaw affects Windows Admin Center, a web-based management tool for Windows Server environments.
An attacker with low privileges (PR:L), such as an authenticated user, can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and without user interaction (UI:N). Successful exploitation allows privilege escalation, granting high-impact access to confidentiality (C:H), integrity (I:H), and availability (A:H) of the affected system.
For mitigation details, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26119.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7587
Vulnerability details
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE description explicitly states an improper authentication flaw in a network-accessible management interface that directly enables privilege escalation from a low-privileged authenticated account, matching the definition of T1068 (Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper authentication flaw in Windows Admin Center, preventing network-based privilege escalation exploitation.
Enforces least privilege to restrict the privileges available for escalation by low-privileged authenticated attackers exploiting the vulnerability.
Requires robust identification and authentication for organizational users, addressing the core improper authentication mechanism in Windows Admin Center.