Ilan Kalendarov

**Name of the Vulnerable Software and Affected Versions** Windows Admin Center (affected versions not specified) **Description** Improper neutralization of input during web page generation leads to cross-site scripting (XSS), which is a flaw where malicious scripts are injected into trusted websites. An unauthorized attacker can craft a malicious gateway URL that triggers a response-based XSS within the error handling of the software. When visited by a privileged Azure administrator, this allows JavaScript execution under the software origin. This can lead to arbitrary PowerShell execution on every managed server the victim has access to without requiring credentials. In on-premises deployments, this chain enables the theft of Azure access and refresh tokens from local storage, allowing for full tenant impersonation and lateral movement into EntraID and Azure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Admin Center (affected versions not specified) **Description** An improper access control issue exists in the Azure Portal Windows Admin Center. This allows an authorized attacker to elevate privileges locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Azure Windows Virtual Machine Agent (affected versions not specified) Azure Arc on Windows (affected versions not specified) **Description** A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacker to bypass authentication using an alternate path or channel. Successful exploitation can lead to local privilege escalation, potentially allowing a low-privileged user to gain higher-level access to the system. A compromised machine running Azure Arc can allow an attacker to abuse the Arc identity flow and potentially pivot into the Azure environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.