CVE-2025-64669

Published Dec 11, 2025

Last updated 17 days ago

Windows Admin Center

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64669 is a local privilege escalation vulnerability in Microsoft's Windows Admin Center (WAC), affecting versions up to 2.4.2.1 and environments running WAC 2411 and earlier. The vulnerability stems from insecure directory permissions on the folder C:\ProgramData\WindowsAdminCenter, which is writable by standard users but used by services running with elevated privileges. An authorized attacker can exploit this improper access control to elevate privileges locally. One exploitation chain involves abusing the extension uninstall mechanism by placing a signed PowerShell script in the writable WAC UI directory, which then gets executed with elevated privileges when the corresponding extension is removed. Another path involves hijacking the updater via a DLL loading flaw.

Description: Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_admin_center

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-284

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:windows_admin_center:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E6B16F7-D308-4FCC-B230-6AFFB020AFE4",
            "versionEndExcluding": "2511"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.