CVE-2025-26633
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Description
CVE-2025-26633 is a high-severity security feature bypass vulnerability in the Microsoft Management Console (MMC) caused by improper neutralization of input. An attacker can craft a malicious MMC snap-in file (.msc) that, when opened by a user, bypasses security restrictions and executes arbitrary code on the system. Rated 7 on the CVSS v3.1 scale with HIGH severity, this vulnerability has been linked to ransomware campaigns. CISA has added CVE-2025-26633 to the Known Exploited Vulnerabilities catalog with a deadline of 2025-04-01, and its EPSS score of 7.10% at the 91.4th percentile indicates substantial exploitation probability, placing it among the top 9% of vulnerabilities most likely to be exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20947 |
| microsoft | windows 10 1607 | < 10.0.14393.7876 |
| microsoft | windows 10 1809 | < 10.0.17763.7009 |
| microsoft | windows 10 21h2 | < 10.0.19044.5608 |
| microsoft | windows 10 22h2 | < 10.0.19045.5608 |
| microsoft | windows 11 22h2 | < 10.0.22621.5039 |
| microsoft | windows 11 23h2 | < 10.0.22631.5039 |
| microsoft | windows 11 24h2 | < 10.0.26100.3403 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7876 |
| microsoft | windows server 2019 | < 10.0.17763.7009 |
| microsoft | windows server 2022 | < 10.0.20348.3270 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1486 |
| microsoft | windows server 2025 | < 10.0.26100.3403 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-detection-script(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-mitigation-script(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26633(US Government Resource)
Weakness Type
CWE-707: Improper Neutralization
CVE-2025-26633 is classified under CWE-707 (Improper Neutralization), which is a broad weakness category covering failures to properly sanitize, validate, or encode data before use. In the Microsoft Management Console (MMC), improper neutralization of specially crafted .msc file content allows an attacker to bypass security features designed to prevent execution of untrusted snap-in configurations.
Learn more: CWE-707 — Improper Neutralization
Impact Analysis
The impact of CVE-2025-26633 is severe across all CIA triad dimensions, compounded by its association with ransomware campaigns. The vulnerability requires local access (AV:L) with high attack complexity (AC:H), no privileges (PR:N), but user interaction (UI:R) to open a crafted .msc file. Confidentiality (High): Bypassing MMC security features allows execution of malicious snap-ins that can read sensitive system data, credentials, and configuration information. Integrity (High): The attacker can modify system configurations, install malware, and alter security settings through the compromised MMC session. Availability (High): Ransomware operators leveraging this vulnerability can encrypt files and render systems inoperable. With a CVSS score of 7 (HIGH), an EPSS score of 7.10% at the 91.4th percentile, and confirmed ransomware usage, this vulnerability represents a critical threat to organizations, particularly because MMC is a trusted administrative tool whose security bypass can evade endpoint detection.
Exploit Maturity
CVE-2025-26633 demonstrates high exploit maturity with confirmed active exploitation and known ransomware usage. CISA has added this vulnerability to the KEV catalog, and the ransomware association significantly elevates the urgency for remediation. The EPSS score of 7.10% at the 91.4th percentile places it in the top 9% of vulnerabilities by exploitation likelihood. Public exploit code is available via Vicarius vSociety detection script and mitigation script. The attack vector leverages crafted .msc files delivered through social engineering, making it particularly effective in phishing campaigns. The combination of MMC being a trusted Windows administrative tool and the availability of public exploit resources creates a dangerous threat landscape where both sophisticated and less-skilled attackers can leverage this vulnerability.
Remediation
-
Apply the March 2025 security update from Microsoft immediately, given the confirmed ransomware association. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Patches are available via Windows Update, WSUS, or the Microsoft Update Catalog.
-
Block .msc file delivery at email gateways, web proxies, and endpoint security tools. Configure Windows Defender SmartScreen and Attack Surface Reduction (ASR) rules to prevent execution of .msc files downloaded from the internet or received via email.
-
Restrict MMC snap-in execution through Group Policy by configuring "Restrict the user from entering author mode" and limiting which snap-ins can be loaded. Use Software Restriction Policies or WDAC to block untrusted .msc files.
-
Deploy ransomware-specific detection including monitoring for rapid file encryption patterns, shadow copy deletion, and known ransomware indicators of compromise. Given the confirmed ransomware link, ensure backup integrity and test recovery procedures.
-
Conduct user awareness training focused on the risks of opening .msc files from untrusted sources. Educate administrators about the specific threat of weaponized MMC snap-in files, as technical staff who regularly use MMC are the most likely targets.
Technical Details
CVE-2025-26633 is an improper neutralization vulnerability (CWE-707) in the Microsoft Management Console (MMC) with the CVSS v3.1 vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability exists in MMC's processing of snap-in configuration files (.msc), where certain elements within the file are not properly validated or neutralized before being processed by the console. An attacker crafts a malicious .msc file that, when opened by a user, exploits the insufficient input validation to bypass MMC security features designed to prevent unauthorized snap-in loading and code execution. The high attack complexity (AC:H) and user interaction requirement (UI:R) reflect the need for social engineering to deliver the crafted .msc file and the specific conditions required for successful exploitation. Despite no authentication requirement (PR:N), the local vector (AV:L) indicates the file must be processed on the target system. The high impact across all CIA dimensions (C:H/I:H/A:H) combined with the confirmed ransomware association demonstrates that threat actors are successfully weaponizing this bypass to deploy ransomware payloads through a trusted Windows administrative interface.
Frequently Asked Questions
Is CVE-2025-26633 being actively exploited?
Yes, CISA has confirmed active exploitation and this vulnerability has a known ransomware association, making it one of the highest-priority patches in the March 2025 update cycle. The EPSS score of 7.10% at the 91.4th percentile confirms widespread exploitation.
What products are affected by CVE-2025-26633?
All supported versions of Microsoft Windows are affected, including Windows 10 1507 through 22H2, Windows 11 22H2/23H2/24H2, and Windows Server 2008 through 2025. Any system with the Microsoft Management Console is vulnerable.
How do I fix CVE-2025-26633?
Apply the March 2025 Microsoft security update immediately. Block .msc file delivery at email gateways, restrict MMC snap-in execution through Group Policy, and deploy Attack Surface Reduction rules to prevent untrusted .msc file execution.
How severe is CVE-2025-26633?
CVE-2025-26633 has a CVSS score of 7 (HIGH) with confirmed ransomware usage. The security feature bypass in MMC allows attackers to execute malicious code through a trusted Windows tool, making it particularly effective for evading security controls.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.