CVE Watch24 sept 2026

CVE-2025-26633

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

CVSS

7.0

Alto

EPSS

30.4%

p98

KEV

SÍ

11 mar 2025

Exploit Today

0-100

Publicado: 11 mar 2025 · Última mod.: 24 sept 2026 · CWE-707

EPSS · 30d

30.4%EPSS · 30 días30.4%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Microsoft / Windows

Vulnerabilidad

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Añadido a KEV

11 mar 2025

Remediar antes de

1 abr 2025

Uso conocido en ransomware

Sí

Descripción resumida

Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26633 ; https://nvd.nist.gov/vuln/detail/CVE-2025-26633

Descripción técnica

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-969518.8 ALT

73.8%

KEV—72Microsoft Windows Command Injection Vulnerability1d CVE-2026-762849.8 CRÍ

24.5%

——7Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.2d CVE-2026-764999.8 CRÍ

21.9%

——7As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.  7d CVE-2026-764538.8 ALT

25.3%

——8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76453 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.7d CVE-2026-971827.3 ALT

29.7%

——9A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.21d CVE-2026-203309.9 CRÍ

25.3%

——8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-20330 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.27d