Actively exploited in the wild
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2025-03-11. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-26633
HighCVSS 7.0KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Risk Assessment
The risk is the possibility of bypassing system security, which could allow an attacker to perform unauthorized actions on the local system.
Recommendation
It is recommended to apply Microsoft patches and restrict access to the management console to trusted users only.
Original NVD description (English source)
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.