CVE-2025-26633 Microsoft Management Console Security Feature Bypass Vulnerability

...

CVE-2025-26633

CVE-2025-26633 is a local-privilege-escalation in Microsoft Management Console (MMC) caused by improper neutralization in how MMC loads language-twin .msc files. A malicious “evil twin” .msc in a language directory can execute payloads with the user’s privileges when a user opens a legitimate MMC...

CVE-2024-45328

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

CVE-2024-45328

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...

CVE-2024-45328

FortiSandbox 4.4.0–4.4.6 contains an improper authorization vulnerability (CWE-863) that can let a low-privilege administrator execute elevated CLI commands via the GUI console menu. Affected component: FortiSandbox GUI/CLI integration (exact files/functions not detailed in the provided sources)....

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24983link is external Microsoft Windows Win32k Use-After-Free Vulnerability CVE-2025-24984link is external Microsoft Windows NTFS Information Disclosure...

Microsoft Management Console Security Feature Bypass Vulnerability

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-0062

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

CVE-2025-0062 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

VulnCheck KEV: CVE-2025-26633

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

CVE-2025-26633

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. Recent assessments: cbeek-r7 at March 26, 2025 11:31am UTC reported: CVE-2025-26633, nicknamed “MSC EvilTwin”, is a security feature bypass vulnerability in Microsoft...

RustDesk Console Detected

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. By leveraging this, a remote and unauthenticated attacker cou...

Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

Microsoft Management Console 安全漏洞

Microsoft Management Console is a general-purpose management console framework from Microsoft Corporation USA that hosts and manages a variety of system management tools called console plug-ins or management units. A security vulnerability exists in Microsoft Management Console. An attacker...

PT-2025-10848

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patch released in March 2025. Description A security feature bypass vulnerability exists in Microsoft Management Console MMC. This vulnerability, also known as MSC EvilTwin CVE-2025-26633, allows an...

RustDesk Console Default Credentials

RustDesk is a mote access and control software that enables management of computers and other devices. RustDesk server Pro embeds a web console allowing users to browse devices and perform configuration modification on the application. A remote and unauthenticated attacker can use the default...

Linux Distros Unpatched Vulnerability : CVE-2023-3161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Framebuffer Console fbcon in the Linux Kernel. When providing font-width and font-height greater than 32 to fbconsetfont, since there ar...

Linux Distros Unpatched Vulnerability : CVE-2022-49441

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tty: fix deadlock caused by calling printk under ttyport-lock ptywrite invokes kmalloc which may invoke a normal printk to print failure message. This can caus...

The vulnerability of the /api/dev-console/proxy/internet file on the Red Hat OpenShift Container Platform corporate platform allows a attacker to perform an SSRF attack.

The vulnerability of the /api/dev-console/proxy/internet file on the Red Hat OpenShift Container Platform corporate platform is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2024-26999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - serial/pmaczilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but i...