The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check whether you have Windows Admin Center installed and determine its current version.
If your version is earlier than 2.7.4, plan to upgrade to Windows Admin Center 2.7.4 or later.
After upgrading, verify the Windows Admin Center service and management pages still work as expected and review admin/server account access to reduce low-privilege entry points.
Document the change and keep an audit trail of who approved and applied the update.
Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.
In plain language
Written by AI from the record
CVE-2026-58631 is a Windows Admin Center flaw that lets a low-privilege user run arbitrary code on the same machine; small businesses should treat this as urgent if an attacker could gain low-level access on your server.
CVE-2026-58631 is an authorization weakness in Windows Admin Center that allows a low-privilege local attacker to execute arbitrary code (local code execution) without user interaction.
If you're affected
Full server compromise
Malware installation
Service disruption
Data theft risk
What is it
Think of Windows Admin Center like a secure “control panel” for managing servers. This bug is a weakness in who is allowed to do powerful actions—someone with limited permissions can potentially trick it into running code of their choice. If that happens, it can turn a limited foothold into a full compromise of that server.
Who is affected
This matters if you use or host Windows Admin Center on a server where an attacker might be able to get low-level permissions (for example, through another account compromise). The risk is primarily local, meaning the attacker needs low-level access on the target system. It’s not a “no access needed” issue—reachability depends on whether an attacker can get that initial low-privilege foothold.
How urgent is it
This is RED because it enables local arbitrary code execution after an attacker obtains low-privilege access, which can quickly escalate to full control. Even without confirmed public exploitation reports in the provided materials, the impact is high and the fix is available. Act immediately to remove the vulnerable version from your environment.
What to do — in detail
Confirm exposure
Identify where Windows Admin Center is installed (server(s) where it runs, including any management gateway hosts).
Determine the installed Windows Admin Center version and record it.
Compare your version to the fixed version: Windows Admin Center is fixed in 2.7.4.
Upgrade / fix
If your version is earlier than 2.7.4, upgrade Windows Admin Center to 2.7.4 or later.
Use Microsoft’s guidance for the correct update path for your deployment (including any gateway components you run).
After upgrade, confirm Windows Admin Center functionality (sign-in, page loads, and typical management actions).
Temporary containment (if you can’t patch immediately)
Reduce the number of accounts with low-privilege access on the WAC host, and review for unnecessary permissions.
Check for any unusual logins or activity on the Windows Admin Center host, especially around admin operations.
Restrict access to the host machine and its management surfaces as much as practical.
What to monitor after patching
Successful logins by local users on the WAC host.
Any management operations that fail unexpectedly or appear unusual.
Audit logs for changes to services, scheduled tasks, or system binaries that could indicate escalation attempts.
KEV note
CVE-2026-58631 is not listed in the CISA KEV set based on the provided findings, so you should rely on your internal version check and upgrade the vulnerable software proactively.
Technical context
CVE-2026-58631 is a local code execution vulnerability caused by improper authorization within Windows Admin Center (CWE-285). In the provided findings, exploitation requires low-level privileges on the target system; there is no user interaction required once the attacker has the needed local foothold. The patch is available: Windows Admin Center is fixed in version 2.7.4. The provided materials do not show CISA KEV inclusion, do not report dated exploitation claims, and do not list public exploit code; however, the capability described is sufficient for a high-priority remediation because authorization failures can enable arbitrary code execution and rapid privilege escalation. The risk is therefore concentrated on environments where an attacker could realistically obtain limited permissions on the machine running Windows Admin Center.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
