PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-26119 PoC: Windows Admin Center authenticated RCE

github.com | tool | CVE-2026-26119 | #ai-security | #rce | #public-poc | #privilege-escalation | #windows-security | #windows-admin-center | #powershell | #exploit | #cve | #poc | #reverse-shell | #cve-2026-26119 | #github-com
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A PoC for CVE-2026-26119, an authenticated remote code execution vulnerability in Windows Admin Center, exploiting the WinREST/PowerShell invokeCommand path with steps to obtain a reverse shell.

Why it matters

The PoC shows that a low-privileged valid account can turn the flaw into remote command execution over the network. Upgrade to Windows Admin Center 2.6.4 or later and review WAC accounts and anomalous PowerShell activity.
CVE
CVE-2026-26119
Vendor
Microsoft
Product
Windows Admin Center
Affected versions
< 2.6.4
CVSS
8.8
Published
Collected

Related coverage

High · vulnerability · semperis.com
What You Need to Know: Windows Admin Center Remote Privilege Escalation (CVE-2026-26119)
The researcher behind CVE-2026-26119 explains the Windows Admin Center remote privilege escalation: how authentication reflection enabled code execution and what the fix teaches about this bug class.
High · vulnerability · github.com
CVE-2026-66804 PoC: Windows Cross Device virtual camera local privilege escalation to SYSTEM
The PoC demonstrates a complete local privilege-escalation chain from a standard user to SYSTEM, and exploit code is now public. Affected Windows endpoints should install Microsoft's August 2026 security updates promptly. Reproduction plants a DLL in a system path and triggers a privileged service, so it should only be performed in an explicitly authorized, recoverable lab environment.
High · vulnerability · github.com
CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass
The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild.
High · vulnerability · github.com
CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation
The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
tool · github.com
Brotli Client Checker: Test Server for Brotli Decoder Vulnerability (CVE-2026-111497)
Provides security teams and developers with a simple, zero-dependency mechanism to test whether backend microservices, crawlers, and HTTP clients are susceptible to the widespread Node2Shell/HTTP2Shell Brotli decoder flaw.
Back