MicrosoftCVE-2026-58643

Microsoft Windows Admin Center: cross-site scripting

Medium6.1CVE-2026-58643 · Published Jul 16, 2026 · updated Aug 14, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows Admin Center Product	>= 1809.0, < 2.6.7	2.6.7

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More Microsoft advisories

All Microsoft

Date	Advisory	Severity	Fixed in
Jul 17	Microsoft Edge (Chromium-based): authentication bypass Medium5.4Jul 17 CVE-2026-57980150.0.4078.80	Medium5.4	150.0.4078.80
Jul 17	Microsoft Windows RDP: unauthorized attacker could disclose information over High7.1Jul 17 CVE-2026-561712.1.65.2+1 more	High7.1	2.1.65.2+1 more
Jul 16	Microsoft Windows Terminal App: integer overflow High7.5Jul 16 CVE-2026-591171.24.11321.0	High7.5	1.24.11321.0
Jul 16	Microsoft Office SharePoint: cross-site scripting Medium4.6Jul 16 CVE-2026-6282616.0.5561.1001+2 more	Medium4.6	16.0.5561.1001+2 more
Jul 16	Microsoft Windows Backup Engine: race condition High7.0Jul 16 CVE-2026-5859810.0.19044.7548+4 more	High7.0	10.0.19044.7548+4 more
Jul 14	Secret exfiltration vulnerability HighJul 14 CVE-2026-472821.128.1	High	1.128.1

Affected versions

More Microsoft advisories

Critical advisories by email