Loading story…
Microsoft released security updates for 50 vulnerabilities, including six actively exploited Windows zero-days in one of the company’s largest recent patch batches. The flaws were identified as CVE-2021-33742, CVE-2021-31955, CVE-2021-31956, CVE-2021-31962, CVE-2021-31199, and CVE-2021-31201, with Microsoft’s advisory also covering the Windows kernel privilege-escalation bug CVE-2021-31956.
Researchers said several of the bugs were already being used in real-world attacks. Google linked CVE-2021-33742, an MSHTML remote code execution flaw tied to Internet Explorer, to a commercial exploit broker and nation-state activity targeting a small number of victims in Eastern Europe and the Middle East. Kaspersky reported that CVE-2021-31955 and CVE-2021-31956 were chained with Chrome-based web delivery to gain elevated privileges on recent Windows 10 systems, while CVE-2021-31199 and CVE-2021-31201 were associated with exploitation tied to Adobe Reader zero-day CVE-2021-28550, affecting older platforms including Windows 7 and Server 2012.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft's June 2021 Patch Tuesday fixed 50 vulnerabilities, including six actively exploited Windows zero-days: CVE-2021-33742, CVE-2021-31955, CVE-2021-31956, CVE-2021-31962, CVE-2021-31199, and CVE-2021-31201. The article described this as the largest batch of actively exploited zero-days Microsoft had patched at once in its recent history.
Adobe patched CVE-2021-28550 in May. The later Microsoft fixes for CVE-2021-31199 and CVE-2021-31201 were described as related to exploitation associated with this Adobe Reader zero-day.
Kaspersky reported a complex exploit chain that used Chrome-based web delivery and the Windows vulnerabilities CVE-2021-31955 and CVE-2021-31956 for sandbox escape and privilege escalation. The exploits were tuned for recent Windows 10 builds, indicating targeting of modern, up-to-date devices.
Google Threat Analysis Group said it discovered CVE-2021-33742 being abused in the wild. Google assessed the exploit as likely developed by a commercial exploit broker and used by a nation-state actor against a small number of victims in Eastern Europe and the Middle East.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft released fixes for 63 vulnerabilities across its product portfolio, including five rated **critical** and one actively exploited zero-day. The exploited flaw, tracked as **`CVE-2025-62215`**, is a Windows kernel double-free race condition that enables **local privilege escalation** to **SYSTEM** without user interaction, according to Microsoft’s Security Update Guide and CSIRT.SK reporting. The November 2025 updates also addressed additional high-severity issues spanning **Windows**, **Microsoft Office**, **Visual Studio**, **Microsoft Graphics Component (GDI+)**, and **Nuance PowerScribe 360**, with impacts including **remote code execution**, **information disclosure**, and **privilege escalation**. Security advisories for vulnerabilities including **`CVE-2025-60716`** and **`CVE-2025-62215`** were published through Microsoft’s update channels, and defenders were urged to deploy the patches promptly because one flaw was already being exploited in the wild.
Jul 24, 2026
Microsoft released its October 2024 security updates with fixes for **118 vulnerabilities** across Windows and other products, including **3 critical flaws**, **5 zero-days**, and **2 vulnerabilities reported as actively exploited in the wild**. The zero-days highlighted in public reporting include `CVE-2024-43573` in **MSHTML**, `CVE-2024-43572` in **Microsoft Management Console** handling of `.msc` files, `CVE-2024-6197` in **libcurl**, `CVE-2024-20659` in **Hyper-V**, and `CVE-2024-43583` in **Winlogon**. Microsoft documented the release in its Security Update Guide release notes. The two exploited issues were identified as an **MSHTML spoofing vulnerability** and a **Microsoft Management Console remote code execution flaw** tied to malicious `.msc` files. Guidance accompanying the release urged organizations to prioritize rapid deployment of the October patches, with additional mitigation advice for `CVE-2024-43583`: administrators were advised to enable the official Microsoft IME to reduce exposure from vulnerable third-party input method editors affecting Winlogon.
Jul 24, 2026