PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42834 Microsoft CVE debrief

CVE-2026-42834 is a high-severity local privilege escalation issue in Azure Portal Windows Admin Center. Microsoft and NVD describe it as improper link resolution before file access (CWE-59), which can allow an authorized attacker with local access and limited privileges to elevate privileges on the host. NVD published the CVE on 2026-05-20 and updated it the same day; the vulnerability is scored 7.8 HIGH.

Vendor
Microsoft
Product
Windows Admin Center
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-20
Advisory published
2026-05-20
Advisory updated
2026-05-20

Who should care

Teams running Microsoft Windows Admin Center in Azure Portal, especially administrators responsible for host hardening, local access control, and patch management. Security teams should pay attention because the attack requires local access and privileges, but can lead to full compromise of confidentiality, integrity, and availability on affected systems.

Technical summary

The issue is a link-following problem: before accessing a file, the application resolves a link in a way that can be abused locally. The NVD vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local, low-complexity attack requiring low privileges and no user interaction. NVD lists the affected Windows Admin Center Azure CPE range as versions before 0.72.0.0. The mapped weakness is CWE-59.

Defensive priority

High. This is not remotely exploitable from the supplied data, but it can still produce full local privilege escalation on affected systems. Prioritize remediation on any Windows Admin Center deployments that allow untrusted or semi-trusted local users, shared admin workstations, or multi-user server environments.

Recommended defensive actions

  • Review Microsoft’s advisory for CVE-2026-42834 and apply the vendor guidance for affected Windows Admin Center deployments.
  • Update Windows Admin Center to 0.72.0.0 or later, based on the NVD vulnerable-version criterion ending before 0.72.0.0.
  • Restrict local access to systems running Windows Admin Center and minimize the number of users with interactive access.
  • Audit where Windows Admin Center is installed in Azure Portal environments and verify that only trusted administrators can use the affected host.
  • Monitor for unusual privilege changes or file-access behavior on hosts that run Windows Admin Center until patched.

Evidence notes

Source data identifies Microsoft as the vendor and Windows Admin Center as the product. The official NVD entry lists the vulnerability as analyzed, with CVSS 7.8 HIGH, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and CWE-59. NVD also provides the vulnerable CPE criterion for microsoft:windows_admin_center in the Azure context with versionEndExcluding 0.72.0.0. A Microsoft MSRC advisory is linked in the NVD references.

Official resources

CVE-2026-42834 was published on 2026-05-20 at 13:16:34.500Z and modified later the same day at 18:29:08.070Z. The supplied source set does not include a separate public disclosure date beyond the NVD publication timestamp and the linked MSR