Azure Identity Token Vulnerability Enables Tenant-Wide Compromise in Windows Admin Center
A critical vulnerability has been identified in the Windows Admin Center's Azure Single Sign-On implementation. This vulnerability, tracked as CVE-2026-20965 , exposes Azure virtual machines and Arc-connected systems to unauthorized access. The flaw,…
A critical vulnerability has been identified in the Windows Admin Center's Azure Single Sign-On implementation. This vulnerability, tracked as CVE-2026-20965 , exposes Azure virtual machines and Arc-connected systems to unauthorized access. The flaw, discovered by Cymulate Research Labs, involves improper token validation, compromising security boundaries across Azure environments.
Microsoft addressed the issue with the release of Windows Admin Center Azure Extension v0.70.00 on Fri, Jan 13, 2026. Systems running versions prior to this update remain vulnerable.
CVE ID Description Severity CVSS Score Affected Versions Patch
CVE-2026-20965 Improper token validation in WAC Azure SSO allows mixing stolen WAC.CheckAccess token with forged PoP token for lateral movement. High Not yet published < 0.70.00 v0.70.00
The exploitation of this vulnerability requires local administrative access on a WAC-enabled Azure VM or Arc machine, along with a privileged user connection via the Azure Portal. While widespread exploitation has not been observed, retrospective detection is recommended.
Windows Admin Center relies on two tokens: WAC.CheckAccess (verifies role-based access) and a PoP-bound token (prevents replay with a browser-generated key pair). The flaws identified include:
A critical vulnerability has been identified in the Windows Admin Center's Azure Single Sign-On implementation.
No UPN matching between tokens. Acceptance of cross-tenant PoP tokens. Non-gateway URLs in PoP, such as direct IP usage via port 6516. Reused nonces and unscoped WAC.CheckAccess granting broad access.
Extract WAC certificate, halt service, initiate a rogue server. Capture the admin's WAC.CheckAccess token during a portal connection. Enumerate targets using metadata or subnet. Forge a PoP using an attacker tenant: generate keys, bind via refresh token, insert target resource ID/IP. Execute InvokeCommand with mixed tokens for RCE on any accessible WAC machine. Repeat for chaining.
This process facilitates lateral movement, privilege escalation, credential theft, and cross-subscription compromise.
Monitor for suspicious WAC virtual accounts such as WAC_user@externaltenant.onmicrosoft.com, which may indicate abuse. Utilize the following KQL query for detecting suspicious logons:
DeviceLogonEvents | where Timestamp > ago(30d) | where AccountName has "@" | where not(AccountName has "<your-tenant>") | project Timestamp, DeviceName, AccountName, ActionType, LogonType | order by Timestamp desc
Flag unusual WAC activities, such as new identities on targets and spikes in InvokeCommand usage within trusted contexts.
Port 6516 open via JIT NSG from all sources. Rogue WAC processes or services. Mixed-tenant UPN logons. Unscoped PoP token reuse.
To mitigate this vulnerability, update to v0.70.00 promptly. Enhance NSG/JIT policies to restrict access to gateway-only routes and regularly monitor WAC logs for anomalies.
This issue highlights the risks associated with Azure SSO, where subtle validation gaps can facilitate local-to-cloud pivots and bypass segmentation. It is crucial to prioritize patching and conduct simulation testing.
Based on reporting by Cyber Security News.