CVE-2026-32196
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Improper neutralization of input during web page generation (cross-site scripting) in Windows Admin Center allows an unauthenticated attacker to perform spoofing over a network.
Risk Assessment
An unauthenticated attacker could exploit XSS to spoof trusted content or users, potentially deceiving administrators and undermining trust in the management console.
Recommendation
Update Windows Admin Center to a patched version and restrict network access to the administrative console.
Other vulnerabilities in Windows Admin Center
See all- CVE-2026-20965High
Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.
- CVE-2026-58643Medium
Cross-site scripting vulnerability in Windows Admin Center. An unauthorized attacker can exploit improper input neutralization during web page generation to perform spoofing over a network.
- CVE-2026-56197High
Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.
- CVE-2026-56196High
A relative path traversal vulnerability in Windows Admin Center allows an authorized attacker to execute code over a network.
- CVE-2026-58631High
An improper authorization vulnerability in Windows Admin Center allows an authorized attacker to execute code locally.
- CVE-2026-57107High
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.
- CVE-2026-56185Medium
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.
- CVE-2026-56169High
An improper authentication vulnerability in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
- CVE-2026-42834High
A vulnerability in Windows Admin Center due to improper access control. It allows an authorized attacker to elevate privileges over a network.
- CVE-2026-41086High
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS