Windows Admin Center Vulnerability Allows Attackers to Escalate Privileges

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Windows Admin Center Vulnerability CVE-2025-64669 Allows Privilege Escalation A local privilege escalation vulnerability, tracked as CVE-2025-64669, has been identified in Microsoft’s Windows Admin Center (WAC), affecting versions up to 2.4.2.1. The flaw arises from insecure directory permissions in the C:\ProgramData\WindowsAdminCenter folder, which is writable by standard users but utilized by services with elevated privileges. 2 sources 49