VULNERABILITY INTELLIGENCE
CVE-2025-66264
EPSS probability0.13%
CISA KEVNot currently listed
Published2025-11-26
Last modified2026-10-18
Description
The CMService.exe service runs with SYSTEM privileges and contains an unquoted service path. This allows a local attacker with write privileges to the filesystem to insert a malicious executable in the path, leading to privilege escalation.
Weakness classification
- b7efe717-a805-47cf-8e9a-921fca0ce0ce: CWE-428