This vulnerability (CWE-79) in Windows Admin Center version 1809.0 allows an attacker to inject malicious scripts due to improper input neutralization during web page generation. This can lead to spoofing attacks over a network, potentially compromising user interaction with the application. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. Microsoft has published an official fix to address this issue.

An attacker can exploit this vulnerability to perform cross-site scripting attacks, enabling spoofing over a network. This may lead to partial confidentiality and integrity impacts but does not affect availability. The attack requires user interaction but no privileges, and can be executed remotely over the network.

An official fix is available from Microsoft. Users should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58643 to remediate this vulnerability.