Windows Admin Center Flaw (CVE-2025-64669): How a Simple Folder Permission Opened the Door to SYSTEM Access

A high-severity flaw in Microsoft’s Windows Admin Center, CVE-2025-64669, has been disclosed by Cymulate Research Labs as a local privilege escalation that lets a standard user gain SYSTEM access on many installations. The root cause is insecure directory permissions in the C:\ProgramData\WindowsAdminCenter folder, which was found writable by all standard users, enabling tampering with files used by the Admin Center’s core processes.

According to Cymulate Research Labs, the researchers identified two exploitation paths, with the most notable involving DLL hijacking of WindowsAdminCenterUpdater.exe, made possible by a Time-of-Check Time-of-Use window that allowed swapping a legitimate file after validation but before the updater ran, resulting in the DLL executing with SYSTEM privileges. Microsoft has acknowledged and patched the issue, and administrators are urged to update to version 2411 or later.

The report notes that the vulnerability could allow escalation from a low-privileged user to SYSTEM, effectively breaking the Windows security boundary, and Microsoft has assigned CVE-2025-64669 with a $5,000 bounty to the researchers.