Microsoft Patches Critical Windows Admin Center Flaw Enabling Full Domain Takeover

Microsoft released an emergency patch for a critical vulnerability in Windows Admin Center (WAC) that allows remote attackers to perform privilege escalation and potentially gain full control over an Active Directory domain. The vulnerability exists in an authentication component that fails to properly validate session tokens in certain race conditions. An attacker with network access to the WAC can escalate to domain administrator privileges. Update Windows Admin Center to version 2511 immediately, restrict access to trusted admin IPs only, implement MFA, and consider isolating WAC in a dedicated management VLAN.