CVE-2025-26633

Published Mar 11, 2025

Last updated 3 months ago

Microsoft

MMC

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-26633 is a security feature bypass vulnerability in the Microsoft Management Console (MMC). It stems from improper neutralization within the MMC, allowing an unauthorized attacker to bypass security restrictions locally. The vulnerability is being actively exploited in the wild by a threat actor known as Water Gamayun (also known as EncryptHub and Larva-208) in a campaign called "MSC EvilTwin". This technique involves the execution of malicious .msc files through a legitimate one by manipulating the Multilingual User Interface Path (MUIPath) to load and execute a malicious file instead of the original one.

Description: Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Source: secure@microsoft.com
NVD status: Modified
Products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_21h2, windows_10_22h2, windows_11_22h2, windows_11_23h2, windows_11_24h2, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Exploit added on: Mar 11, 2025
Exploit action due: Apr 1, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-707
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "6997DE6E-CBAD-4690-A68C-8F10E477DCC2",
            "versionEndExcluding": "10.0.10240.20947"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "3CBCF6D9-5085-473C-82F5-98BC246A9C4C",
            "versionEndExcluding": "10.0.10240.20947"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "0CF0E174-4692-4AA3-B72E-12E73A1BDBE5",
            "versionEndExcluding": "10.0.14393.7876"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "340EF5F8-D4F5-4AD8-9D80-1DEC2F376BE5",
            "versionEndExcluding": "10.0.14393.7876"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "67C8DCD7-90C4-431F-BD03-FDFDE170E748",
            "versionEndExcluding": "10.0.17763.7009"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "05169574-28AB-4E42-B3DE-710574BB1AD3",
            "versionEndExcluding": "10.0.17763.7009"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "714C0D5E-BE31-45AB-A729-FF55DE59F593",
            "versionEndExcluding": "10.0.19044.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "0C8B2D45-7059-4FA0-A46C-64A171D287DA",
            "versionEndExcluding": "10.0.19044.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "5569800D-B907-47CC-86D2-EC0118157916",
            "versionEndExcluding": "10.0.19044.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "A84E706C-3A65-4920-8F80-2A684D3CB110",
            "versionEndExcluding": "10.0.19045.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "ED157557-37C1-4802-8746-B87120BA16FA",
            "versionEndExcluding": "10.0.19045.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "BE8F0EF2-EED3-4791-AE26-D24D97B673D6",
            "versionEndExcluding": "10.0.19045.5608"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "C8949B3E-5847-42F8-A15A-D7515F0EE305",
            "versionEndExcluding": "10.0.22621.5039"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "84D4F97D-3BA2-4B7A-B650-5772DE49CE97",
            "versionEndExcluding": "10.0.22621.5039"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "82807292-1736-4453-B805-3D471BF94A35",
            "versionEndExcluding": "10.0.22631.5039"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "E19130AD-ECD6-4FC4-B2C8-AB058BDEF928",
            "versionEndExcluding": "10.0.22631.5039"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "B7ADF37E-1DD3-4539-8922-1E059955FEF1",
            "versionEndExcluding": "10.0.26100.3403"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "E0A74D52-ABC0-4733-B892-F8688B6AEBA7",
            "versionEndExcluding": "10.0.26100.3403"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "2127D10C-B6F3-4C1D-B9AA-5D78513CC996"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*",
            "vulnerable": true,
            "matchCriteriaId": "AB425562-C0A0-452E-AABE-F70522F15E1A"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AAACC9C4-DDC5-4059-AFE3-A49DB2347A86",
            "versionEndExcluding": "10.0.20348.3270"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "96046A7B-76A1-4DCF-AEA5-25344D37E492",
            "versionEndExcluding": "10.0.25398.1486"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "CE542697-31D8-4EC2-8135-F0468431FD19",
            "versionEndExcluding": "10.0.26100.3403"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.