CVE-2025-26633

HighCVSS 7.0/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-707

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2025
Last modified
Sep 24, 2026
Added to CISA KEV
Mar 11, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-266347.5Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network.CVE-2025-266356.5Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network.CVE-2025-266365.5Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose informaCVE-2025-266376.8Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-266397.8Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.CVE-2025-26647.2A vulnerability was found in CodeZips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown funcCVE-2025-266407.0Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-266417.5Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.CVE-2025-266427.8Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-266435.4The UI performs the wrong action in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2025-266445.1Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorCVE-2025-266458.8Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2025-26633: High severity, CVSS 7.0 | Vulnix