cve 2026 20965

CVE-2026-20965 is a high-severity vulnerability in Windows Admin Center's Azure Active Directory Single Sign-On integration. The flaw allowed a local administrator on a single WAC-managed virtual machine to combine a stolen access token with a forged Proof-of-Possession token, enabling impersonation of privileged users and command execution across all Windows Admin Center instances in the same Azure tenant. The issue stems from improper token validation in WAC's Azure extension and was patched in the Windows Admin Center Azure Extension release 0.70.00 in mid-January 2026. Administrators should prioritize applying this patch to prevent cross-tenant privilege escalation attacks.