CVE-2025-26651

Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.

Scoring

Severity

MEDIUM

CVSS base score

6.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

EPSS probability

2.52%

CWE

CWE-749

Published

2025-04-08

Last modified

2026-08-10

Affected products

• Microsoft Windows 11 version 22H2
• Microsoft Windows 11 version 22H3
• Microsoft Windows 11 Version 23H2
• Microsoft Windows 11 Version 24H2
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
• Microsoft Windows Server 2025
• Microsoft Windows Server 2025 (Server Core installation)

Weakness type

• CWE-749

Related vulnerabilities

• CVE-2018-10931 — It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unaut
• CVE-2023-27363 — Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability
• CVE-2023-38124 — Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability
• CVE-2023-51581 — Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
• CVE-2023-51575 — Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
• CVE-2021-34996 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.
• CVE-2023-51582 — Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability
• CVE-2023-44414 — D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability

Markdown version · Browse all CVEs