Ben Zamir

**Name of the Vulnerable Software and Affected Versions** Windows Admin Center (affected versions not specified) **Description** Improper neutralization of input during web page generation leads to cross-site scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites. An unauthorized attacker can craft a malicious gateway URL that triggers a response-based XSS within the error handling of the software. When visited by a privileged Azure administrator, this allows JavaScript execution under the software origin. This can lead to arbitrary PowerShell execution on every managed server the victim has access to without requiring credentials. In on-premises deployments, this chain enables the theft of Azure access and refresh tokens from local storage, allowing for full tenant impersonation and lateral movement into EntraID and Azure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Windows Virtual Machine Agent (affected versions not specified) Azure Arc on Windows (affected versions not specified) **Description** A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacker to bypass authentication using an alternate path or channel. Successful exploitation can lead to local privilege escalation, potentially allowing a low-privileged user to gain higher-level access to the system. A compromised machine running Azure Arc can allow an attacker to abuse the Arc identity flow and potentially pivot into the Azure environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Windows versions (affected versions not specified) Description A flaw in Windows HTTP.sys related to improper access control can allow an authorized attacker to elevate privileges over a network. This issue can be exploited remotely. The vulnerability enables Kerberos authentication relay to Active Directory Certificate Services (AD CS) via DNS CNAME abuse, bypassing NTLM protections. A proof-of-concept (PoC) has been released demonstrating how attackers can manipulate DNS CNAME resolution to coerce Windows clients into requesting Kerberos tickets for attacker-controlled Service Principal Names (SPNs), enabling credential relay and lateral movement. This poses a risk to Active Directory networks, even when NTLM is disabled. Mitigation means removing relay opportunities at the service layer. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Admin Center versions prior to 0.70.00 **Description** Improper verification of cryptographic signatures in the Azure AD SSO implementation of Windows Admin Center allows an authorized attacker with local administrator access on a machine to bypass authentication and authorization mechanisms. The issue stems from the improper validation of Proof-of-Possession (PoP) tokens, where a stolen admin access token can be mixed with a forged PoP token to impersonate privileged users. This can lead to local privilege escalation, lateral movement across the entire tenant, and tenant-wide remote code execution (RCE). The exploitation involves sending a specially crafted HTTPS request. **Recommendations** Update Windows Admin Center Azure Extension to version 0.70.00 or later.