Windows Admin Center Vulnerability Enables Privilege Escalation

Security researchers have identified a serious vulnerability in Microsoft’s Windows Admin Centre (WAC) that allows standard users to escalate their privileges to the SYSTEM level.

The flaw, tracked as CVE-2025-64669, stems from insecure folder permissions and affects all versions up to WAC 2411.

The vulnerability exists in the C:\ProgramData\WindowsAdminCenter directory, which is writable by all standard users.

This misconfiguration becomes dangerous because privileged processes load content directly from this folder.

Attackers with basic user access can exploit this weakness through multiple attack paths to gain complete administrative control.

The Discovery

Cymulate researchers discovered the issue while investigating how Windows Admin Center handles installation, updates, and extension management.

After decompiling the .NET binaries, they identified two distinct exploitation methods that could be chained together to break the Windows security boundary.

Microsoft confirmed the vulnerability and awarded Cymulate a $5,000 security bounty for responsible disclosure.

Exploitation Method One: Extension Uninstall Abuse

The first attack vector abuses how Windows Admin Center uninstalls extensions.

The application searches the uninstall folder for PowerShell scripts and executes them with the AllSigned execution policy under elevated privileges.

Since the parent directory is writable by all users, attackers can place malicious signed PowerShell scripts in the uninstall folder.

When the uninstall process is triggered through the user interface, the script executes with NETWORK SERVICE or SYSTEM privileges.

Researchers demonstrated this by creating a custom uninstall folder, placing a signed malicious script in it, and triggering the uninstall process via WAC’s API. Their payload successfully executed in an elevated context.

Exploitation Method Two: DLL Hijacking

The second attack vector targets the Windows Admin Center updater mechanism. The updater loads DLLs from C:\ProgramData\WindowsAdminCenter\Updater, a directory writable by standard users.

While the updater includes signature validation, researchers discovered a Time-of-Check Time-of-Use (TOCTOU) weakness.

They created a PowerShell script that monitors the updater process starting, then immediately copies a malicious DLL into the updater folder. This timing allows the malicious DLL to load without passing signature validation.

The researchers demonstrated the attack by creating a custom user32.dll that wrote to a test file.

Using only standard user privileges, they triggered an update through the API endpoint, and their DLL executed with SYSTEM privileges.

Windows Admin Center is widely deployed across enterprises globally. IT administrators rely on WAC to manage servers, clusters, and hybrid cloud environments at scale.

The vulnerability’s broad impact affects organizations of all sizes, from small businesses to global enterprises.

Any attacker with local access to a Windows Admin Center gateway server can exploit this vulnerability to gain administrative privileges.

This threatens the integrity of entire infrastructure management systems and could lead to widespread compromise across managed servers.

Microsoft released patches to address this vulnerability. Organizations should immediately update Windows Admin Center beyond version 2411 and review their WAC deployments for exposure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.