CVE-2025-26633

CVE-2025-26633 is a high-severity vulnerability in Microsoft Management Console (MMC) that allows an unauthorized attacker to bypass security features locally due to improper neutralization. This flaw affects Microsoft products and carries a CVSS score of 7.0. The vulnerability has a high potential impact, enabling an attacker to achieve high confidentiality, integrity, and availability compromise with high attack complexity. Critically, this CVE is actively exploited in the wild, notably by the Russia-aligned APT Water Gamayun in a campaign dubbed 'MSC EvilTwin,' and has been linked to ransomware campaigns. Despite active exploitation, there are no public exploit modules available, but it garners significant community discussion and media coverage.