Notifications
Clear all
Topic starter
02/08/2026 12:12 pm
TL;DR: Writable program data in Windows Admin Center enabled two privilege-escalation paths from standard user to SYSTEM through extension uninstall abuse and updater DLL hijacking, according to Cymulate. The issue shows how trust boundaries break when privileged processes load user-writable content.
NHIMG editorial — based on content published by Cymulate: CVE-2025-64669 local privilege escalation in Windows Admin Center
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when a management tool trusts user-writable paths?
A: A writable path turns a storage location into an execution surface if a privileged process reads scripts or DLLs from it.
Q: Why do privileged Windows services create high-risk trust assumptions?
A: Privileged services often assume that files in their working directories are trustworthy because the directories are local and operational.
Q: How can security teams measure whether local privilege escalation risk is actually controlled?
A: Track whether any privileged process executes from user-modifiable directories, whether ACLs on management paths are restrictive, and whether detections exist for script or DLL replacement between validation and load.
Practitioner guidance
- Harden writable management directories Remove standard-user write access from Windows Admin Center program data and any sibling folders that privileged services consume.
- Separate execution from user-controlled content Refactor uninstall and update workflows so privileged processes never execute scripts or load binaries from user-writable locations.
- Monitor for privilege escalation indicators Use endpoint telemetry and SIEM detections for suspicious PowerShell execution, DLL placement in updater directories, and child processes launched by WAC components.
What's in the full report
Cymulate's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step exploit paths for extension uninstall abuse and updater DLL hijacking
- The exact proof-of-concept flow used to trigger SYSTEM execution from a low-privileged account
- Disclosure timeline details, including Microsoft validation and patching milestones
- Validation guidance for testing Windows Admin Center exposure in live environments
👉 Read Cymulate's analysis of CVE-2025-64669 in Windows Admin Center →
Windows Admin Center privilege escalation: what did practitioners miss?
Explore further
02/08/2026 1:15 pm
Writable management paths create a hidden privilege plane: This vulnerability is not just about a bad directory permission. It shows that management tooling often creates a second, weaker access layer where filesystem write access can override intended administrative controls. In practice, privileged automation is only as safe as the least protected path it trusts.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs , Key Research and Survey Results.
- Related finding: 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a management-plane flaw exposes administrative access?
A: The owning platform team and the identity governance function share accountability, because the flaw spans application design and privileged access control. Management consoles should be governed like identity infrastructure, with clear ownership for redirect policy, token handling, session design, and secure update response when flaws are found.
👉 Read our full editorial: Windows Admin Center privilege escalation shows trust-boundary gaps
