CVE-2025-26633KEV · OVERDUECWE-707

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

High · published March 11, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.0. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

572
days past CISA
deadline
CVSS v3.1
7.0
EPSS
30%
Percentile
98.2
In the wild
Confirmed
What it is

⚡ An unauthorized user can easily bypass security features in Microsoft Management Console, like a guest slipping through a hotel door meant for staff only! 🚪 Think of it like a restaurant where anyone can walk into the staff area and access the kitchen — that's what this flaw allows! The console doesn't properly check who is trying to enter, leading to potentially disastrous results. An attacker exploiting this vulnerability could gain unauthorized access to sensitive features, potentially altering system configurations or accessing confidential data. This could lead to system mismanagement or a complete breach of your infrastructure, which is absolutely devastating!

Put simply

Think of it like a restaurant where anyone can walk into the staff area and access the kitchen — that's what this flaw allows! The console doesn't properly check who is trying to enter, leading to potentially disastrous results. The vulnerability stems from improper neutralization in the Microsoft Management Console, allowing an unauthorized attacker to bypass local security features, thereby gaining elevated privileges.

What to do

An attacker exploiting this vulnerability could gain unauthorized access to sensitive features, potentially altering system configurations or accessing confidential data. This could lead to system mismanagement or a complete breach of your infrastructure, which is absolutely devastating! To mitigate this risk, ensure that you apply the latest security updates from Microsoft and review your security configurations in the Management Console. Implement strict access controls to minimize exposure and monitor for any unauthorized access attempts. You've got this! Follow these steps to secure your system and become a security hero! 🦸‍♀️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.30391 · 98.2th percentile
Weakness
CWE-707 · Improper Neutralization
Published
2025-03-11T21:16Z
KEV added
2025-03-11 · due 2025-04-01
Affected products (28)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2094710.0.10240.20947
microsoft/windows_10_1507< 10.0.10240.2094710.0.10240.20947
microsoft/windows_10_1607< 10.0.14393.787610.0.14393.7876
microsoft/windows_10_1607< 10.0.14393.787610.0.14393.7876
microsoft/windows_10_1809< 10.0.17763.700910.0.17763.7009
microsoft/windows_10_1809< 10.0.17763.700910.0.17763.7009
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_21h2< 10.0.19044.560810.0.19044.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_10_22h2< 10.0.19045.560810.0.19045.5608
microsoft/windows_11_22h2< 10.0.22621.503910.0.22621.5039
microsoft/windows_11_22h2< 10.0.22621.503910.0.22621.5039
microsoft/windows_11_23h2< 10.0.22631.503910.0.22631.5039
microsoft/windows_11_23h2< 10.0.22631.503910.0.22631.5039
microsoft/windows_11_24h2< 10.0.26100.340310.0.26100.3403
microsoft/windows_11_24h2< 10.0.26100.340310.0.26100.3403
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.787610.0.14393.7876
microsoft/windows_server_2019< 10.0.17763.700910.0.17763.7009
microsoft/windows_server_2022< 10.0.20348.327010.0.20348.3270
microsoft/windows_server_2022_23h2< 10.0.25398.148610.0.25398.1486
microsoft/windows_server_2025< 10.0.26100.340310.0.26100.3403
References (4)
EPSS history
Timeline
  • 11 MAR 16:59Z
    Microsoft Management Console Security Feature Bypass Vulnerability
    cvelistv5
  • 11 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 1
    kev