CVE-2025-26633
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-26633. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1EPSS Score
v2025.03.14There is a 4.8% chance that this vulnerability will be exploited in the wild within the next 30 days.
Attack Vector Metrics
Impact Metrics
Description
No description available
Available Exploits
Related News
EncryptHub actor exploits Windows flaw CVE-2025-26633 (“MSC EvilTwin”) with rogue MSC files and social engineering to drop malware. The threat actor EncryptHub exploits the now-patched Windows flaw CVE-2025-26633 (“MSC EvilTwin”) using rogue MSC files and soc…
The threat actors behind the zero-day exploitation of a recently-patched security vulnerability in Microsoft Windows have been found to deliver two new backdoors called SilentPrism and DarkWisp. The activity has been attributed to a suspected Russian hacking …
Trend Research discusses the delivery methods, custom payloads, and techniques used by Water Gamayun, the suspected Russian threat actor abusing a zero-day vulnerability in the Microsoft Management Console framework (CVE-2025-26633) to execute malicious code …
A zero-day vulnerability tracked as CVE-2025-26633 is being actively exploited in the wild by a sophisticated Russian-linked threat The post CVE-2025-26633: Water Gamayun Exploits Windows MMC in Active Zero-Day Campaign appeared first on Cybersecurity News.
Trend Research identified Russian threat actor Water Gamayun exploiting CVE-2025-26633, a zero-day vulnerability in the Microsoft Management Console that attackers exploit to execute malicious code and exfiltrate data.
Affected Products
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Product
Ransomware Risk
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: March 11, 2025, Modified: April 16, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
🔥 Top 10 Trending CVEs (18/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-8091](https://nvd.nist.gov/vuln/detail/CVE-2025-8091)** - 📝 The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to …
EncryptHub Strikes Again A dangerous Russian hacking group is exploiting a patched Windows flaw (MSC EvilTwin, CVE-2025-26633) using fake Teams requests and rogue MSC files to deliver Fickle Stealer malware. Tactics include PowerShell commands, abusing Brave Support, and encrypted C2 traffic for stealth.
🚨 Breaking Cyber Intelligence: EncryptHub Hits with MSC EvilTwin Exploit 🚨 https://preview.redd.it/9v4v98b5dmjf1.png?width=1024&format=png&auto=webp&s=a47c2d665a0cecdb070c9f4a90d097cf3b710899 **Who:** Russian-linked EncryptHub (aka LARVA-208 / Water Gamayun) **What:** Exploiting Windows MMC flaw **CVE-2025-26633** (“MSC EvilTwin”) to deploy **Fickle Stealer**, an advanced PowerShell-based info stealer. [X (formerly Twitter)+11Cyber Security News+11Security Affairs+11](https://cybersecuritynews.com/microsoft-teams-request-remote-access/?utm_source=chatgpt.com) **How they attack:** 1. Initiate contact via …
🔥 Top 10 Trending CVEs (17/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-26633](https://nvd.nist.gov/vuln/detail/CVE-2025-26633)** - 📝 Microsoft Management Console Security Feature Bypass Vulnerability - 📅 **Published:** 11/03/2025 - 📈 **CVSS:** 7 - 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - 📣 **Mentions:** 61 - ⚠️ **Priority:** 2 - …
Hackers Exploit Microsoft Teams to Gain Remote Access **A new social engineering campaign leverages Microsoft Teams requests to compromise corporate networks by mimicking IT support teams.** **Key Points:** - Attackers impersonate IT staff using Microsoft Teams to gain remote access. - Exploitation of the MSC EvilTwin vulnerability allows malware delivery. …
Russian Hacking Group EncryptHub Exploits Microsoft Flaw to Distribute Fickle Stealer Malware **A Russian hacking group is exploiting a patched Microsoft vulnerability to deploy advanced malware through social engineering tactics.** **Key Points:** - EncryptHub combines social engineering and technical exploits to infect targets. - The group utilizes a Microsoft Management …
Russian Group EncryptHub Exploits MSC EvilTwin Vulnerability to Deploy Fickle Stealer Malware The threat actor known as EncryptHub is continuing to exploit a now-patched security flaw impacting Microsoft Windows to deliver malicious payloads. Trustwave SpiderLabs said it recently observed an EncryptHub campaign that brings... **CVEs:** CVE-2025-26633 **Source:** https://thehackernews.com/2025/08/russian-group-encrypthub-exploits-msc.html
🔥 KELA Midyear Report: 2025’s Top Cyber Threats So Far Some major findings from[ TechNadu’s breakdown](https://www.technadu.com/top-threats-in-2025-cl0p-ransomware-lumma-stealer-and-several-flaw-exploits/605507/) of KELA’s midyear threat report: **💥 Ransomware** * Cl0p leads with 408 victims * Akira up 202% YoY * Qilin breached Lee Enterprises * RansomHub linked to Medusa & BianLian via EDRKillShifter **🦠 Infostealers** …