Loading story…
Microsoft has released security updates addressing more than 230 vulnerabilities across Windows and related components, with national cyber authorities urging organizations to prioritize deployment. NCSC-NL highlighted five of the most severe issues—CVE-2026-59124, CVE-2026-62815, CVE-2026-62878, CVE-2026-62893, and CVE-2026-65791—affecting Microsoft HPC Pack, Microsoft QUIC, Windows DNS, Windows Deployment Services, and Windows iSCSI Target Service. According to the advisory, these flaws could enable unauthenticated remote code execution or unauthorized access on exposed systems.
The broader update set spans core Windows services and subsystems and includes vulnerabilities tied to privilege escalation, remote code execution, information disclosure, denial of service, spoofing, security feature bypass, and data tampering. The guidance applies across supported Windows 10, Windows 11, Windows Server, Windows App Client for Windows Desktop, and Windows Remote Help products. NCSC-NL assessed the likelihood of exploitation as medium and the potential impact as high, reinforcing Microsoft's recommendation that defenders accelerate patching of affected environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE record states that disclosure@vulncheck.com received the CVE-2026-72742 submission concerning Stanford NLP DSPy. The flaw is a file exfiltration issue in DSPy's Image and Audio output field adapters.
NCSC-NL published advisory NCSC-2026-0284 with final status, highlighting five especially severe Microsoft flaws affecting HPC Pack, Microsoft QUIC, Windows DNS, Windows Deployment Services, and Windows iSCSI Target Service. The advisory broadly applies to supported Windows desktop, server, and related products.
An advisory states that Microsoft fixed more than 230 vulnerabilities across Windows and related components, including multiple critical remote code execution flaws. NCSC-NL urged organizations to prioritize deployment of the updates because of the scale and severity of the issues.
A new CVE record was added for CVE-2026-72742, affecting Stanford NLP DSPy versions up to and including 3.3.0b1. The vulnerability allows untrusted model output to trigger local file reads and base64-encoded exfiltration to an attacker-controlled model endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecve.circl.lu
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its March 2025 security updates to address **58 vulnerabilities** across Windows, Office, Azure components, Visual Studio, and related enterprise software, including **23 remote code execution** flaws and **six critical vulnerabilities**. The most severe issues affected **Microsoft Office**, **Microsoft Dataverse**, **Windows Remote Desktop Services**, **Remote Desktop Client**, **Windows DNS**, and **Windows Subsystem for Linux 2**, with impacts ranging from remote code execution to privilege escalation. The update also remediated several vulnerabilities reported as **actively exploited**, including `CVE-2025-24983` in the **Windows Win32 Kernel Subsystem**, alongside flaws in **Microsoft Management Console**, **Windows NTFS**, and the **Windows Fast FAT File System Driver**. Microsoft said the **Dataverse** issue `CVE-2025-24053` was mitigated automatically and required no customer action, while defenders were urged to deploy the broader patch bundle promptly to reduce exposure across supported Windows client and server environments.
Jul 24, 2026
Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.
Jun 29, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026