CVE-2025-26633highunder attackransomwareCWE-707

CVE-2025-26633: high-severity vulnerability in Microsoft Windows 10 Version 1507

Microsoft Management Console Security Feature Bypass Vulnerability

Published 11 Mar 2025 · Updated 05 Aug 2026

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7epss 30%

from disclosure to weapon28 days

Published on NVDMar 11

1st PoC+28d

CISA KEVMar 11

exploitation probability

30%top 2% of all CVEs

observed exploitation

yesCISA + VulnCheck

4 public exploit(s)

Action required by CISAfederal deadline: 2025-04-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Microsoft Management Console has a flaw that lets someone with local access bypass a security feature meant to protect your system. This could allow them to do unauthorized actions they shouldn't be able to do.

Technical detail

A improper neutralization vulnerability in Microsoft Management Console permits local attackers to circumvent security controls through exploitation of insufficient input validation or access control mechanisms. Requires local system access; successful exploitation results in bypass of intended security restrictions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Affected products

public PoCs found — 4

exploitdbwww.exploit-db.com/exploits/52498unverified githubgithub.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation★ 4 githubgithub.com/sandsoncosta/CVE-2025-26633★ 2 vulncheckvulncheck.com/xdb/32970494431dunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Microsoft Windows 10 Version 1507

In the same product, most dangerous first.

CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEV CVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEV CVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEV CVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 98.9%KEV CVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.8%KEV CVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.1%KEV

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26633 https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-detection-script https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-mitigation-script