The vulnerability “… allows an attacker with local administrator access on just one machine to escalate privileges, execute remote code, and move laterally across Azure virtual machines and Arc-connected systems within the same tenant, without valid Azure credentials,” said Cymulate researchers.
Tracked as CVE-2026-20965, this flaw impacts organizations using Windows Admin Center to manage Azure VMs and Arc-connected systems, especially where admins frequently connect via the Azure Portal.
The core risk is that an attacker who gains a foothold on one WAC-managed system can potentially use that access to move laterally and reach other machines across the tenant.
Windows Admin Center’s Azure SSO flow relies on two separate tokens working together.
The first, WAC.CheckAccess, is used to confirm the user has the required role-based permissions.
The second is a proof-of-possession (PoP) token, which is designed to prevent token replay by binding authentication to cryptographic keys generated in the browser.
Under normal conditions, this pairing helps ensure that even if a token is stolen, it cannot be reused from another context.
Cymulate researchers found that WAC did not validate these tokens as tightly as it should.
In practice, attackers could mix a stolen WAC.CheckAccess token with a forged PoP token, allowing them to impersonate privileged users and remotely execute administrative commands on other WAC-enabled systems.
The issue stems from multiple validation gaps, including missing UPN checks between tokens, acceptance of cross-tenant PoP tokens, nonce reuse, and PoP support for non-gateway URLs like direct IP access over port 6516.
Even more importantly, the WAC.CheckAccess token was not sufficiently scoped, meaning authorization could extend beyond a single machine and effectively enable broader, tenant-level access patterns.
Exploitation is not completely “drive-by.”
The attacker must already have local administrator access on a WAC-enabled Azure VM or Arc-connected machine, and a privileged user must initiate a WAC session through Azure Portal during the attacker’s window of opportunity.
But once those conditions are met, the blast radius can be significant — enabling lateral movement, privilege escalation, and broad compromise of systems that were assumed to be isolated.
Microsoft has released a patch to address the issue, and organizations should apply it immediately while also reviewing logs for signs of token misuse or unusual cross-tenant identity activity.
Organizations running Windows Admin Center in Azure should treat CVE-2026-20965 as a high-priority risk because it can turn a single compromised host into a broader tenant-wide exposure.
Security teams should also assume token abuse may be difficult to spot without focused monitoring.
These steps outline practical actions to help close the gap, limit lateral movement, and detect suspicious WAC activity early.
This vulnerability is a reminder that identity and token validation flaws can turn routine admin workflows into tenant-wide risk, especially in cloud environments built for speed and scale.
Organizations should prioritize patching Windows Admin Center immediately, then reinforce access controls, network restrictions, and monitoring to reduce the blast radius if a single system is compromised.
This is why organizations are shifting to a zero-trust security model built around assuming breach and limiting impact.
The post Windows Admin Center Azure SSO Flaw Risks Tenant-Wide Compromise appeared first on Website Hosting Review.
Cloud storage makes it easy to store and access files from anywhere, but it also…
Flare researchers have identified a threat actor known as TeamPCP behind a large-scale campaign targeting…
Threat actors are using artificial intelligence (AI) to accelerate cloud intrusions. In a recent incident…
A newly discovered vulnerability in Traefik’s experimental ingress-nginx provider silently disabled TLS certificate verification for…
Effective fire prevention in data centers requires a coordinated approach that adapts to evolving hazards…
Deployment of direct liquid cooling (DLC, as cold plate or immersion systems) remains overwhelmingly concentrated…