One-Click RCE in Azure Windows Admin Center Lets Attackers Execute Arbitrary Commands

**Executive summary:** A critical chained vulnerability (CVE-2026-32196) in Microsoft Windows Admin Center allows attackers to use a crafted gateway URL to trigger response-based XSS and control-flow hijacking, leading to unauthenticated one-click PowerShell RCE on on-prem WAC instances and theft of Azure access/refresh tokens from browser local storage; Azure-hosted WAC was remediated server-side while on-prem customers must apply the Microsoft update, restrict access, and audit tokens and gateway exposure.