CVE-2025-26633: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Other sources
Microsoft Management Console Security Feature Bypass Vulnerability
— Microsoft
Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22470Patch KB5053887 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.25368Patch KB5053886 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.27618Patch KB5053627 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.6003.23168Patch KB5053995 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.7876Patch KB5053594 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.10240.20947Patch KB5053618 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.1486Patch KB5053599 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.3476Fixed in 10.0.26100.3403Patch KB5053636 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.5039Patch KB5053602 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.5608Patch KB5053606 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22621.5039Patch KB5053602 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.5608Patch KB5053606 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.3328Fixed in 10.0.20348.3270Patch KB5053638 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.7009Patch KB5053596
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26633?
CVE-2025-26633 has a high severity rating as it allows unauthorized attackers to bypass security features locally in Microsoft Management Console.
How do I fix CVE-2025-26633?
To remediate CVE-2025-26633, apply the latest security patches provided by Microsoft for your affected Windows product.
Which software versions are affected by CVE-2025-26633?
CVE-2025-26633 impacts several Microsoft products including various versions of Windows Server and Windows 10, 11.
Can CVE-2025-26633 be exploited remotely?
No, CVE-2025-26633 is a local attack vulnerability, meaning it requires local access to the affected system to exploit.
What are the potential impacts of CVE-2025-26633 if exploited?
Exploitation of CVE-2025-26633 could lead to unauthorized access to sensitive configurations and management actions on the affected Windows system.