CVE-2025-26633 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-03-11

Added to CISA KEV: 2025-03-11 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for suspicious MMC usage, check for unauthorized privilege escalation, verify admin account integrity
Apply Microsoft security updates immediately for all affected Windows systems
Monitor for unusual MMC.exe process activity and unexpected snap-in loading
Implement principle of least privilege to limit potential impact of security feature bypasses
HIGH PRIORITY patching due to CISA KEV listing and active exploitation

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-26633 is a security feature bypass vulnerability affecting the Microsoft Management Console (MMC) ^[3]. It was addressed by Microsoft as part of the March 2025 Patch Tuesday updates ^[1].

Vulnerability Overview

Nature of Vulnerability: Improper neutralization of input in the Microsoft Management Console (MMC) ^[3].
Technical Root Cause: The vulnerability stems from how MMC (`.msc`) files are handled, which allows an attacker to evade file reputation protections ^[2].
CVSS Score: 7.0 (High) ^[2].

Exploitation and Impact

Exploitation Requirements:

* Access Level: Requires local access to the target system ^[3]. * User Interaction: While specific details on the necessity of user interaction are not always explicitly detailed in every advisory, the nature of bypassing file reputation protections typically implies that a user must be induced to open a malicious `.msc` file.

Impact: Successful exploitation allows an attacker to bypass security features and execute code in the context of the current user ^[2]. This can potentially lead to privilege escalation, data theft, or further system compromise ^[5] ^[4].

Threat Landscape

Active Exploitation: While the March 2025 Patch Tuesday release included several vulnerabilities that were actively exploited in the wild, reports generally categorize CVE-2025-26633 as a security feature bypass that Microsoft addressed, and it is frequently listed alongside other critical vulnerabilities patched at that time ^[1].
Ransomware/Targeted Attacks: There is no specific, widely publicized evidence linking this CVE exclusively to a single major ransomware campaign or targeted APT group in the available documentation; however, its ability to bypass security protections makes it a valuable primitive for attackers in various stages of an attack chain.

Mitigation and Patch Status

Patch Status: Microsoft released a patch for this vulnerability in the March 2025 security updates ^[4].
Recommendation: Organizations are strongly advised to apply the relevant security updates provided by Microsoft to mitigate the risk of exploitation ^[4].

Sources

CVE-2025-26633 | Tenable
Microsoft addresses 56 CVEs, including seven zero-day flaws, with six of those being exploited in the wild. References. Advisories. Exploits. Tenable Blogs.https://www.crn.com/news/security/2025/microsoft-discloses-extraordinary-number-of-actively-exploited-vulnerabilities-researcher. ... Microsoft’…
URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively...
CVE-2025-26633 (CVSS score: 7.0) - An improper neutralization vulnerability in Microsoft Management Console that allows an unauthorized attacker to bypass a security feature locally.The Zero Day Initiative noted that CVE-2025-26633 stems from how MSC files are handled, allowing an attacker to evade…
CVE-2025-26633 Detail - NVD
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. ... Information Technology Laboratory National Vulnerability Database Vulnerabilities ... Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further g…
CVE-2025-26633 Description, Impact and Technical Details
CVE-2025-26633 is a vulnerability affecting Microsoft Management Console (MMC). An attacker can exploit this improper neutralization issue to bypass security features locally, gaining unauthorized access. This vulnerability may lead to potential data theft or system compromise if an adversary succes…
CVE-2025-26633 - Exploits & Severity - Feedly
Threat Intelligence Report CVE-2025-26633 is a critical vulnerability in the Microsoft Management Console (MMC) that allows attackers with local access to bypass a key security feature due to improper input sanitization, potentially leading to privilege escalation. While the specific CVSS score and…

🟢 CVE-2025-26633