Loading story…
Microsoft has confirmed the phased removal of Defender Application Guard (MDAG) from Office, with the process beginning in February 2026 and concluding by December 2027. MDAG, which isolates untrusted Office documents in a Hyper-V sandbox to protect against malware, will be replaced by alternative security measures such as Protected View, Defender for Endpoint attack surface reduction (ASR) rules, and Windows Defender Application Control. The company cites performance improvements and a streamlined security experience as reasons for the change, while also acknowledging that the isolation approach, though effective, introduced slower document load times and was occasionally susceptible to vulnerabilities in the sandbox layer.
Administrators are advised to prepare for the transition by enabling recommended alternative protections, as no direct action is required for the removal itself. Microsoft has provided a detailed timeline for the deprecation across different Office update channels, ensuring enterprises have ample time to adapt. The move aligns with the end of support for Windows 11 version 23H2 and reflects a broader shift in Microsoft's security strategy for Office environments.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed that Defender Application Guard for Office will be fully removed from enterprise Windows environments by late 2027. The change means administrators may need to update workflows and security processes that depended on the feature.
Microsoft announced the deprecation of Microsoft Defender Application Guard for Office, ending the Hyper-V-based sandboxing feature used to isolate untrusted Office documents. The company said organizations should transition to alternatives such as Attack Surface Reduction rules and Windows Defender Application Control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has announced the end-of-life (EOL) for several widely used software products, including Windows 10, Office 2016, Office 2019, Exchange Server 2016, and Exchange Server 2019, marking a significant transition for organizations relying on these platforms. The final security updates for Office 2016 and Office 2019 will be released this month, after which these products will no longer receive security patches or technical support. Organizations are strongly encouraged to migrate to newer versions such as Office 2024 or Office LTSC 2024, which will be supported through October 2029, or to adopt Microsoft 365 Apps for ongoing feature and security updates. The end of support for Exchange Server 2016 and 2019 is closely linked to Office upgrades, with Microsoft recommending migration to Exchange Online or the subscription edition for continued security and compliance. For Windows 11, Microsoft has issued reminders that the Home and Pro editions of version 23H2 will reach end of servicing on November 11, 2025, after which they will no longer receive monthly security or preview updates. Enterprise, Education, and IoT Enterprise editions of Windows 11 23H2 will remain supported until November 2026, providing organizations with additional time to plan migrations. Users are advised to upgrade to Windows 11 24H2 or later, with automatic updates available for unmanaged devices, though some systems may be held back due to compatibility issues such as the presence of SenseShield Technology code-obfuscation drivers. The transition to newer software versions is critical to maintaining security, as unsupported products become increasingly vulnerable to emerging threats. Microsoft has also introduced new tools, such as Windows Backup for Organizations, to facilitate smoother migrations and ensure business continuity. The company emphasizes the importance of timely upgrades to minimize operational and security risks associated with unsupported software. These EOL milestones represent the culmination of nearly a decade of service for several Microsoft products, underscoring the need for proactive IT planning. Organizations that have not yet migrated are urged to act quickly to avoid exposure to unpatched vulnerabilities. The coordinated end-of-support for multiple products may require significant resource allocation and careful scheduling to ensure seamless transitions. Microsoft’s guidance and new migration tools are designed to support enterprises through this period of change, but the responsibility for timely action rests with IT leaders. Failure to upgrade could result in compliance issues, increased attack surface, and potential business disruptions. The end-of-life announcements serve as a critical reminder of the ongoing lifecycle management required for enterprise software environments.
Jun 29, 2026
Microsoft is dealing with administrator backlash over Windows update quality and lifecycle changes after cumulative update `KB5094126` reportedly broke Word OLE and COM-based integrations used by line-of-business applications including CCH Engagement, with sysadmins also citing impacts on Dentrix and SoftDent workflows. Separate reports tied the same update to missing taskbar clock and hidden system tray behavior on some Windows 11 systems, with community workarounds ranging from uninstalling the patch to registry edits and system repair steps, while one discussion said Microsoft planned a follow-up update to address the CCH Engagement Word COM plugin issue. At the same time, Microsoft clarified how Windows monthly releases, optional preview updates, hotpatching, and out-of-band fixes are delivered, while shipping Windows 10 ESU update `KB5099539` with Remote Desktop security hardening and OLE Automation fixes. The company also warned that Windows 11 24H2 Home and Pro will stop receiving updates on October 13, 2026, while Windows 10 remains widely deployed despite rising exposure as support windows narrow and ESU coverage remains temporary, increasing pressure on enterprises to modernize systems without disrupting critical application dependencies.
Jul 16, 2026
Microsoft published advisories for **Windows Defender Credential Guard** security feature bypass vulnerabilities tracked as `CVE-2022-21921` and `CVE-2024-43451`. The notices indicate that protections designed to isolate and safeguard credentials in Windows can be circumvented under certain conditions, potentially weakening a key defense against credential theft and lateral movement on affected systems. The disclosures add to Microsoft's ongoing stream of Security Update Guide entries covering Windows authentication and isolation protections. For defenders, the immediate concern is whether affected Windows endpoints and servers have received the relevant Microsoft security updates, because a successful bypass of **Credential Guard** can reduce the effectiveness of one of the platform's primary controls for protecting cached and derived credentials.
Jul 12, 2026