CVE-2025-26633

Microsoft Windows Management Console (MMC) contains an improper neutralization flaw (CWE-707) that allows an unauthorized attacker to bypass a security feature locally. It is triggered when MMC processes specially crafted input during local use, letting the attacker sidestep a built-in Windows security control. The attacker gains evasion of that security feature, which is most valuable as one stage of a broader attack chain rather than as a standalone compromise. Virtually any organization running affected Microsoft Windows releases is affected, since MMC ships with Windows by default. The flaw is already being exploited in the wild: CISA added it to the KEV catalog on 2025-03-11 with known ransomware use, and EPSS places its 30-day exploitation probability at 30.4% (98th percentile), though no public proof-of-concept is known.

What to do: Apply Microsoft's security updates per vendor instructions as required under CISA KEV/BOD 22-01, prioritizing this patch given known ransomware use and the KEV deadline. Inventory Windows endpoints and servers for patch status and hunt for anomalous MMC execution until updates are applied; for cloud services, follow applicable BOD 22-01 guidance, and discontinue or mitigate use where patches are unavailable.