CVE-2025-26633

What it actually does

CVE-2025-26633 is a Microsoft Management Console security feature bypass caused by improper neutralization of crafted console content. An attacker who can get a user to open a malicious Microsoft Management Console file can cause MMC to mishandle untrusted input and bypass local Windows protections that would normally restrict or warn on unsafe content. In practical attacks, this can enable execution of attacker-controlled commands or payloads in the context of the user who opened the file, often through mmc.exe spawning scripting interpreters, LOLBins, or malware loaders.

Why it matters to the business

This vulnerability is actively exploited in the wild, is listed in CISA KEV, has a CISA remediation due date of 2025-04-01, and is associated with ransomware activity, making it a high-priority endpoint risk. Successful exploitation can lead to malware installation, credential theft, lateral movement, data theft, and ransomware deployment after a user opens a malicious management console file. Because MMC is a built-in Windows administrative component, abuse may blend into normal administrative activity unless process behavior and downloaded file execution are monitored closely.

How an attack unfolds

An attacker typically begins by delivering a crafted Microsoft Management Console file through phishing, drive-by download, file-sharing links, or another social-engineering channel. The file may be named to appear like an administrative tool, document, invoice, help file, or troubleshooting utility. When the user opens it, Windows launches mmc.exe to parse the console file. Due to improper neutralization, the crafted content bypasses an intended local security protection and can trigger attacker-controlled behavior. The attacker then uses the resulting execution path to launch a script interpreter or living-off-the-land binary such as powershell.exe, cmd.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, or bitsadmin.exe. From there, the attacker retrieves or unpacks a second-stage payload, establishes persistence, performs discovery, steals credentials, moves laterally, and may ultimately deploy ransomware. Reported exploitation activity and KEV status indicate this should be treated as an active threat rather than a theoretical issue.

How to fix it

Apply the Microsoft security update that addresses CVE-2025-26633 on all supported Windows systems; because no per-product fixed versions were provided, use Microsoft’s March 2025 security updates or later cumulative updates for the affected Windows platforms. Prioritize internet-facing workstations, administrator workstations, jump hosts, systems used to open email attachments, and endpoints used by privileged users. If immediate patching is not possible, reduce exposure by blocking or quarantining .msc files from email and web downloads, restricting users from opening unsolicited MMC console files, using application control to limit mmc.exe child processes, and enforcing endpoint detection rules for mmc.exe spawning script interpreters or LOLBins. Maintain Microsoft Defender, EDR, SmartScreen, and attachment scanning controls at current signatures and policies. Treat this as urgent because it is KEV-listed, actively exploited, and associated with ransomware campaigns.

How to confirm the fix worked

Confirm that affected Windows systems have installed the relevant March 2025 or later Microsoft cumulative/security update that includes the fix. Validate through centralized patch management, Windows Update history, vulnerability scanner plugins, or authenticated inventory checks against Microsoft’s security update guidance. Test detection controls by verifying alerts trigger when mmc.exe opens an .msc file from a user download or temporary directory and attempts to spawn powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, curl.exe, bitsadmin.exe, or similar child processes. Confirm email, web proxy, and EDR controls inspect or block unsolicited .msc attachments and downloads. Review a representative sample of endpoints for recent suspicious mmc.exe executions before considering remediation complete.

Typical attack path

1. Attacker prepares a malicious .msc Microsoft Management Console file or a file designed to be opened by MMC.
2. Attacker delivers the file through phishing, a malicious download, file share, collaboration platform, removable media, or another social-engineering route.
3. User opens the file locally, causing mmc.exe to process the crafted console content.
4. The vulnerability allows bypass of an intended local Windows security feature during MMC handling of the file.
5. mmc.exe launches or indirectly triggers attacker-controlled commands, scripts, or payload loaders under the user’s privileges.
6. Payload retrieves additional malware or executes embedded code using common Windows utilities or scripting engines.
7. Attacker establishes persistence, performs reconnaissance, steals credentials, and attempts lateral movement.
8. If monetization is the objective, the attacker stages data theft and deploys ransomware.

How to detect it

Look for evidence that MMC was used to open suspicious local console files and then launched unexpected child processes. Primary log sources include EDR process telemetry, Sysmon Event ID 1 process creation, Windows Security Event ID 4688 process creation, PowerShell Event IDs 4103 and 4104, Windows Defender events, SmartScreen and Attachment Execution Service events, email gateway attachment logs, proxy/download logs, browser download history, and file system artifacts such as Prefetch, Amcache, Shimcache, RecentDocs, Jump Lists, and UserAssist. Hunt for mmc.exe executions where the command line references .msc files located in user-writable paths such as Downloads, Desktop, Temp, AppData, browser cache, email attachment cache, or extracted archive folders. Treat as suspicious any mmc.exe process that spawns powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, schtasks.exe, or encoded PowerShell. Also inspect for immediate outbound network connections following mmc.exe execution, newly created scheduled tasks, Run key persistence, startup-folder files, dropped executables in user profile paths, and ransomware pre-encryption behavior such as mass file discovery, shadow copy deletion, backup tampering, and security tool impairment. Where threat intelligence mentions exploitation by recent campaigns, correlate suspicious MMC activity with phishing delivery, newly downloaded .msc files, and post-exploitation command chains rather than relying on file hashes alone.

• mmc.exe
• *.msc
• mmc.exe powershell.exe
• mmc.exe cmd.exe
• mmc.exe wscript.exe
• mmc.exe cscript.exe
• mmc.exe mshta.exe
• mmc.exe rundll32.exe
• mmc.exe regsvr32.exe
• mmc.exe certutil.exe
• mmc.exe bitsadmin.exe
• mmc.exe curl.exe
• mmc.exe schtasks.exe
• ParentImage=\mmc.exe
• ParentProcessName=mmc.exe
• Image=\Windows\System32\mmc.exe
• OriginalFileName=mmc.exe
• \Users\*\Downloads\*.msc
• \Users\*\Desktop\*.msc
• \Users\*\AppData\Local\Temp\*.msc
• \Users\*\AppData\Local\Microsoft\Windows\INetCache\*.msc
• \Users\*\AppData\Local\Microsoft\Windows\Temporary Internet Files\*.msc
• \Users\*\AppData\Local\Microsoft\Windows\Explorer\*.msc
• \Users\*\AppData\Local\Packages\*\TempState\Downloads\*.msc
• powershell.exe -EncodedCommand
• powershell.exe -enc
• cmd.exe /c
• mshta.exe http
• regsvr32.exe /s /n /u /i:
• rundll32.exe javascript:
• certutil.exe -urlcache
• bitsadmin /transfer
• vssadmin.exe delete shadows
• wmic.exe shadowcopy delete
• bcdedit.exe /set {default} recoveryenabled no
• schtasks.exe /Create
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKLM\Software\Microsoft\Windows\CurrentVersion\Run

What your security team should do

• Immediately verify deployment of the Microsoft update addressing this vulnerability across Windows endpoints and servers; prioritize privileged user workstations and systems that receive email or web downloads.
• Because this is KEV-listed, actively exploited, and linked to ransomware, handle missing patches as an emergency remediation item and align remediation tracking to the 2025-04-01 KEV due date if applicable.
• Block or quarantine .msc files from external email and web downloads unless there is a documented business need.
• Create high-severity detections for mmc.exe spawning scripting engines, command shells, download utilities, or LOLBins, especially when the parent .msc file originated from Downloads, Temp, email cache, browser cache, or archive extraction paths.
• Hunt retrospectively for suspicious mmc.exe execution and child processes since at least the publication date, 2025-03-11, and extend the lookback where endpoint telemetry allows.
• Add application control or attack surface reduction policies to prevent Office, browsers, archive tools, and email clients from launching MMC files or child process chains through mmc.exe.
• Review phishing reports, email gateway logs, and proxy logs for delivered or downloaded .msc files and quarantine any suspicious messages or files.
• If suspicious execution is found, isolate the endpoint, collect forensic artifacts, rotate potentially exposed credentials, and investigate for second-stage malware, persistence, lateral movement, and ransomware staging.