CVE-2025-26633

This vulnerability affects Microsoft Management Console (a built-in Windows admin tool). Attackers can exploit a flaw to bypass a local security protection, making it easier to do the next steps that lead to compromise. In real-world attacks tied to ransomware, attackers have been using it.

This matters if you run any of the listed Windows systems (Windows Server 2008/2008 R2/2012/2012 R2/2016/2019/2022/2025, Windows 10, Windows 11) where Microsoft Management Console is present. While it’s described as a local bypass, ransomware campaigns have been using it—so if an attacker can get a foothold on a machine, they may be able to progress more easily. Treat this as urgent for any server or workstation that could be reached by attackers (for example, via exposed services, phishing leading to access, or other compromise paths), because CISA lists it as used in ransomware.

This is RED because it’s confirmed in real-world ransomware activity (CISA KEV) and public exploit code exists. You should treat it as an actively abused local security bypass on affected Windows systems and ensure the fixed Windows updates are applied without delay—by the CISA remediation due date.

1. Confirm scope (find the exact OS builds):
   • For each server/workstation, record the Windows version and build number.
   • Only consider machines that match the affected products list (Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2025, Windows 10, Windows 11).
2. Verify whether the fix is installed:
   • Compare each machine’s current OS build to the fixed versions Microsoft lists for CVE-2025-26633.
   • If your build number is equal to or newer than the fixed target for your OS branch, you are covered for that branch.
3. Patch immediately for missing systems (target fixed versions):
   • Windows 10:
     • 10.0.10240.20947
     • 10.0.14393.7876
     • 10.0.17763.7009
     • 10.0.19044.5608
     • 10.0.19045.5608
   • Windows 11:
     • 10.0.22621.5039
     • 10.0.22631.5039
     • 10.0.26100.3476
   • Windows Server 2008 R2:
     • 6.1.7601.27618
   • Windows Server 2008:
     • 6.0.6003.23168
   • Windows Server 2012:
     • 6.2.9200.25368
   • Windows Server 2012 R2:
     • 6.3.9600.22470
       Use Microsoft’s official update guidance for CVE-2025-26633 when selecting/installing the correct update.
4. If patching can’t be finished by the due date:
   • Apply any mitigations provided in Microsoft’s vendor instructions for CVE-2025-26633.
   • If mitigations are unavailable for a particular machine, CISA guidance indicates discontinuing use of the product until mitigations can be applied.
   • For cloud services, follow the applicable BOD 22-01 guidance referenced in the CISA KEV entry.
5. What to monitor after patching:
   • Look for signs of compromise around the time of the KEV-listed campaigns (unusual admin tool activity, suspicious local actions, and any related follow-on behaviors).
   • Ensure endpoint protection and logging are enabled so you can detect and respond quickly if attackers gained access before the fix.

CVE-2025-26633 is a Microsoft Management Console (MMC) security feature bypass (CWE-707) where improper neutralization allows an unauthorized local attacker to evade a security control. The vulnerability is listed in CISA KEV (added 2025-03-11) with confirmation tied to ransomware campaigns, so exploitation should be treated as real for affected environments. Public exploit availability is noted (2 known), indicating mature weaponization. The traffic-light verdict for this CVE is RED due to KEV-confirmed exploitation. EPSS is reported as 30.4% with a rising trend, but KEV/news-confirmed exploitation takes precedence for urgency and public communication. The practical risk is highest on machines that could be accessed locally by an attacker (direct access, stolen credentials, or other foothold paths), because the bypass is local and depends on attacker presence/reachability on the host.