CVE-2025-26633: Microsoft Management Console improper neutralization security feature bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known ransomware use and a high EPSS percentile, but exploitation requires local access and user interaction, which limits mass remote exploitation.

What it is

Microsoft Management Console (MMC) fails to properly neutralize input, letting an attacker bypass a security feature. The flaw affects a broad set of Windows client and server releases and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is being used in the wild. It matters because a security control that defenders rely on can be evaded on unpatched systems.

Impact

An attacker can bypass an MMC security feature, which can lead to code execution, data modification, and denial of service given the CVSS impact ratings of High for confidentiality, integrity, and availability. The practical gain is evasion of a protection mechanism rather than direct remote takeover.

Attack surface

The CVSS vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), so the attacker needs local access or a way to run code on the host and must induce a user to act. It is not remotely reachable without that local foothold and interaction.

Exploitation

CISA added it to KEV on 2025-03-11 with a due date of 2025-04-01 and flags known ransomware campaign use; EPSS is 0.30391 (98th percentile), and third-party references are tagged Exploit. This indicates active exploitation, not just theoretical risk.

What to do

• Apply the Microsoft security update for CVE-2025-26633 across all affected Windows client and server versions listed in the advisory.
• Follow CISA KEV required actions and BOD 22-01 guidance, prioritizing internet-facing and high-value systems by the 2025-04-01 due date.
• If patching cannot be completed immediately, apply vendor-recommended mitigations or restrict use of MMC where operationally feasible.
• Limit local interactive access and execution rights for untrusted users to reduce the local attack surface this flaw requires.
• Track the KEV entry and re-check for updated vendor guidance if mitigations change.

Detection

• Monitor for unusual or unexpected MMC (mmc.exe) process execution, especially child processes or module loads that deviate from normal administrative use.
• Hunt for MMC spawning command interpreters or scripting engines, which can indicate security feature bypass activity.
• Correlate local user interaction events with MMC activity on hosts that have not yet applied the March 2025 updates.
• Review endpoint telemetry for known exploitation artifacts referenced by the third-party detection guidance linked in the advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.