CVE-2025-26633

Microsoft · Published March 11, 2025

7.0

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Microsoft Management Console (MMC) security feature bypass allows attackers to execute malicious .msc files by bypassing Windows file reputation checks. Used by Water Gamayun (UAT-5647) threat group.

Affected Products

Windows 10/11 (all versions)
Windows Server 2016/2019/2022/2025

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Related Advisories

CVEHIGHCVE-2025-26633

Microsoft MMC Zero-Day (CVE-2025-26633) Exploited by Water Gamayun for MSC File Execution

A Windows Management Console security feature bypass was exploited by the Russian-linked Water Gamayun group to execute malicious .msc files, bypassing Windows file reputation and MotW protections.

WHY IT MATTERS

Double-clicking a .msc file attachment now represents a critical attack vector — update Group Policy to restrict .msc execution from untrusted paths.

MicrosoftWindowsZero Day+1 more

Mar 11, 2025· 4 min read