CVE-2025-26633
HIGH KEV RANSOMWAREMicrosoft Management Console - Auth Bypass
Title source: llmExploitation Summary
CVE-2025-26633 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 11, 2025, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including Mohammed Idrees Banyamer, mbanyamer, sandsoncosta.
AI-analyzed exploit summary This Python script generates a malicious .msc file that exploits CVE-2025-26633 to execute arbitrary PowerShell commands, specifically adding a local administrator account. The exploit leverages Microsoft Management Console (MMC) to achieve local privilege escalation.
Description
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
Exploits (3)
This Python script generates a malicious .msc file that exploits CVE-2025-26633 to execute arbitrary PowerShell commands, specifically adding a local administrator account. The exploit leverages Microsoft Management Console (MMC) to achieve local privilege escalation.
This PoC demonstrates CVE-2025-26633, a local privilege escalation vulnerability in Microsoft Management Console (MMC) via a malicious .msc file. It creates a local administrator account when executed by a user with sufficient privileges.
This PoC exploits CVE-2025-26633 by dropping malicious `.msc` files in the Windows System32 directory, which are then executed via MMC to achieve remote command execution. The exploit involves a multi-stage payload delivery mechanism, including a PowerShell dropper and a secondary payload fetch.
References (4)
Scores
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H