CVE-2025-26633
Published: 11 March 2025
Summary
CVE-2025-26633 is a high-severity Improper Neutralization (CWE-707) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique MMC (T1218.014); ranked in the top 2.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper neutralization flaw in Microsoft Management Console by applying timely vendor patches from Microsoft's update guide.
Addresses the root cause of CWE-707 improper neutralization by validating inputs to MMC, preventing security feature bypass exploits.
Scans and monitors for known vulnerabilities like CVE-2025-26633 in MMC, enabling identification and prioritization for remediation given its presence in CISA KEV catalog.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local security feature bypass in MMC, directly enabling adversaries to use MMC for proxy execution of malicious payloads or snap-ins while evading intended controls.
NVD Description
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Deeper analysisAI
CVE-2025-26633 is an improper neutralization vulnerability in the Microsoft Management Console (MMC) that enables an unauthorized attacker to bypass a security feature locally. Published on 2025-03-11, the issue is associated with CWE-707 and carries a CVSS v3.1 base score of 7.0 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high potential impact despite requiring local access and user interaction.
An unauthorized attacker with local access to the system can exploit this vulnerability, which demands high attack complexity and user interaction but no special privileges. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, effectively bypassing MMC security controls.
Microsoft's Security Response Center provides an update guide for remediation at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633. Vicarius offers a detection script at https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-detection-script and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-mitigation-script.
The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26633, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025