Loading story…
Check Point Research disclosed multiple vulnerabilities in Microsoft Management Console (MMC) that could allow attackers to execute code by convincing a user to open a specially crafted .msc file. The issues affected the way MMC handled console files and embedded resources, creating a path for arbitrary code execution in a trusted Windows administrative tool commonly used to manage system components and enterprise infrastructure.
The report showed that the flaws could be abused through social engineering and weaponized management console files, turning a routine administrative interface into an attack vector. For defenders, the disclosure highlighted the risk of treating .msc files as inherently safe, the need to apply Microsoft patches, and the importance of restricting or monitoring execution of administrative tools that can be repurposed for initial access or post-compromise activity.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published research detailing vulnerabilities in Microsoft Management Console (MMC). The reference indicates public disclosure of the findings but provides no additional event details in the supplied content.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro disclosed multiple **critical** vulnerabilities in the **Apex One management console** that could let remote attackers upload malicious code and execute commands on affected systems. The issues include `CVE-2025-54948`, a **CVSS 9.8** directory traversal flaw in the console that can be exploited **without authentication** because of improper validation of a user-supplied path before file operations; successful exploitation can lead to arbitrary code execution in the context of `IUSR`. Public reporting also identified related critical flaws `CVE-2025-71210` and `CVE-2025-71211`, which similarly enable remote code upload and command execution through different executables in the console. Trend Micro said the vulnerabilities were reported through the **Zero Day Initiative** and released updates and guidance for affected customers. The vendor said **SaaS deployments were already mitigated** and require no customer action, but warned that exploitation depends on access to the Apex One Management Console, which listens on **TCP 8080** and **4343** by default in the case of the traversal issue. Organizations with **externally exposed console IPs** were urged to apply patches and restrict source access or otherwise limit exposure until remediation is complete.
Jun 29, 2026
Microsoft published security advisories for three **elevation of privilege** vulnerabilities affecting **Microsoft Management Console**, **Microsoft Partner Center**, and **Microsoft 365 Copilot**. The issues are tracked as `CVE-2026-27914`, `CVE-2026-24303`, and `CVE-2026-33102`, respectively, and were added to the Microsoft Security Update Guide as separate product-specific flaws. The disclosures indicate that both on-premises administrative tooling and cloud-connected Microsoft services are affected by privilege-escalation weaknesses. While Microsoft did not provide public synopses in the referenced advisories, the listings identify the impacted products and classify each issue as an elevation of privilege vulnerability, signaling potential risk to administrators, partners, and enterprise users relying on those platforms.
Jul 12, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026