CVE-2026-42834 Details
Description
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
A vulnerability allowing improper link resolution before file access has been identified in the Windows Admin Center extension within the Azure Portal. This issue allows an authorized attacker to locally elevate privileges. The vulnerability arises from inadequate handling of link resolution, which could be exploited to gain unauthorized access to elevated rights.
To address this vulnerability, customers should install the latest version of the Windows Admin Center extension through the Azure Portal. There is no direct download link; instead, customers need to open the Extensions + Applications blade for their virtual machine in the Azure Portal and search for the extension named AdminCenter (Microsoft.AdminCenter.AdminCenter). From there, they can add or update the extension following the standard Azure VM extension installation process.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42834 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| microsoft windows admin center | < 0.72.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | [email protected] |
| May 20, 2026 | Initial Analysis | [email protected] |
| May 20, 2026 | New CVE Received | [email protected] |