HIGH🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2025-26633

CVSS 7.0v3.1pub. 2025-03-11upd. 2025-10-27

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Windows 10 1507
OS
Microsoft
< 10.0.10240.20947
Microsoft Windows 10 1607
OS
Microsoft
< 10.0.14393.7876
Microsoft Windows 10 1809
OS
Microsoft
< 10.0.17763.7009
Microsoft Windows 10 21h2
OS
Microsoft
< 10.0.19044.5608
Microsoft Windows 10 22h2
OS
Microsoft
< 10.0.19045.5608
Microsoft Windows 11 22h2
OS
Microsoft
< 10.0.22621.5039
Microsoft Windows 11 23h2
OS
Microsoft
< 10.0.22631.5039
Microsoft Windows 11 24h2
OS
Microsoft
< 10.0.26100.3403
Microsoft Windows Server 2008
OS
Microsoft
r2
Microsoft Windows Server 2012
OS
Microsoft
r2
Microsoft Windows Server 2016
OS
Microsoft
< 10.0.14393.7876
Microsoft Windows Server 2019
OS
Microsoft
< 10.0.17763.7009
Microsoft Windows Server 2022
OS
Microsoft
< 10.0.20348.3270
Microsoft Windows Server 2022 23h2
OS
Microsoft
< 10.0.25398.1486
Microsoft Windows Server 2025
OS
Microsoft
< 10.0.26100.3403

CISA KEV — detailsi

Vendori: Microsoft ↗
Producti: Windows
Added to KEVi: March 11, 2025
Remediation deadline (US Federal)i: April 1, 2025(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory Microsoft↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.

🔴