This vulnerability, identified as CWE-79, occurs in Microsoft Windows Admin Center 1809.0 due to improper neutralization of input during web page generation. This flaw enables an unauthorized attacker to conduct spoofing attacks over a network by injecting malicious scripts. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. Microsoft has published an official fix for this vulnerability.

An attacker exploiting this vulnerability can perform spoofing attacks by injecting malicious scripts into web pages generated by Windows Admin Center. This can lead to partial compromise of confidentiality and integrity of information accessible through the affected interface. There is no impact on availability. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users of Windows Admin Center version 1809.0 should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32196. No additional mitigation actions are required once the patch is applied.