Loading story…
Microsoft released fixes for CVE-2020-0674, a memory corruption flaw in the Internet Explorer scripting engine that could let an attacker execute arbitrary code in the context of the current user. The company said the vulnerability had been publicly disclosed and exploited in the wild, and warned that systems where users hold administrative privileges could be fully compromised. Microsoft also published mitigations and a workaround that restricts access to JScript.dll, noting that IE11, IE10, and IE9 typically use Jscript9.dll, which is not affected, and that exposure is tied to sites invoking the legacy JScript engine.
Microsoft’s related guidance on Internet Explorer Enhanced Security Configuration (IE ESC) highlights defensive measures for Windows Server environments that reduce exposure to web-based attacks. IE ESC hardens browser security zones, restricts scripting, ActiveX, downloads, and third-party extensions, and reinforces Microsoft’s recommendation to minimize web browsing from servers and tightly control trusted and intranet site assignments. The guidance also warns that incorrectly adding Internet sites to the Local intranet zone can automatically send user credentials, increasing risk during browser-based exploitation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2020-0674, a scripting engine memory corruption vulnerability in Internet Explorer that can lead to remote code execution, and released security updates for affected Internet Explorer versions on supported Windows platforms. Microsoft said the flaw had been publicly disclosed and was being exploited in the wild at the time of publication.
Microsoft published guidance describing Internet Explorer Enhanced Security Configuration on Windows Server, including how it restricts scripting, ActiveX, downloads, and other browser features to reduce exposure to web-based attacks.
Microsoft revised the CVE-2020-0674 advisory to add mitigation and workaround guidance aligned with ADV200001, including that the JScript.dll workaround should be used only when customers could not install the February security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcetechnet.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published a detailed patch analysis and proof-of-concept exploit for **CVE-2016-0189**, a VBScript engine memory corruption flaw in **Internet Explorer 11** that had already been used in targeted attacks in South Korea. The analysis of Microsoft bulletin **MS16-051** found two patched issues in `vbscript.dll`: a missing `SafeArray` lock in the `AccessArray` function that can enable out-of-bounds read/write during array resizing, and an `IsUnsafeAllowed` logic flaw that bypasses VBScript safety checks. Chaining the bugs allows arbitrary memory read/write and modification of `COleScript` safety settings to enable unsafe script execution in IE11 on Windows 10. The accompanying GitHub repository released a public exploit for Windows 10 and IE11, lowering the barrier to reproducing the attack path. The researchers noted the exploit was not fully reliable and might require repeated page loads, but showed how the vulnerability could still be leveraged despite Internet Explorer Protected Mode. Their write-up also described using a localhost/Intranet trust-based technique, previously documented by Zero Day Initiative, to move from a Protected Mode context toward **Medium integrity** code execution.
Jul 24, 2026
Microsoft released security update **3034682** to address **41 vulnerabilities** in Internet Explorer **6 through 11**, including multiple flaws that could allow **remote code execution** if a user visited a specially crafted webpage. The most severe issues could let an attacker run code with the same privileges as the current user, making the risk highest on systems where users have administrative rights. Microsoft rated the bulletin **Critical** for affected Windows client systems and **Moderate** for affected Windows server systems. The bulletin said one flaw, **CVE-2015-0071**, had been exploited in the wild, while **CVE-2014-8967** had been publicly disclosed before the patch was issued. Microsoft said the update corrects memory corruption and permission-validation issues, improves **ASLR** behavior, and strengthens cross-domain policy enforcement. It also noted that systems running Internet Explorer **9, 10, and 11** require updates **3021952** and **3034196** for full protection, with **3023607** and, on some platforms, **3036197** also potentially installed automatically.
Jun 29, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026