Loading story…
Security researchers have disclosed a critical vulnerability in the .NET Framework's SoapHttpClientProtocol class, which is widely used in enterprise applications to handle SOAP messages. The flaw allows attackers to manipulate the target URL, enabling remote code execution (RCE) by redirecting SOAP requests to unintended destinations, such as local files or other protocols. Despite the severity and broad impact, Microsoft has reportedly declined to issue a fix, leaving numerous vendor and in-house solutions potentially exposed to exploitation.
The vulnerability has been demonstrated against several high-profile products, including Barracuda Service Center RMM (patched as CVE-2025-34392), Ivanti Endpoint Manager, Umbraco 8 CMS, Microsoft PowerShell, and Microsoft SQL Server Integration Services. Researchers warn that the list of affected products is likely much larger due to the prevalence of the vulnerable class in .NET-based codebases. The issue was presented at Black Hat Europe 2025, and while some vendors have issued patches, many applications remain at risk due to the underlying framework flaw and Microsoft's decision not to address it directly.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
watchTowr Labs published technical details on the SOAPwn issue, describing how hidden non-HTTP URL handling in .NET SOAP client proxies can be abused across many enterprise and in-house applications. The disclosure highlighted the broad impact beyond the specifically named products.
Microsoft repeatedly refused to treat the underlying .NET Framework behavior as a vulnerability, classifying it as an application-level issue and advising developers not to allow untrusted input into affected proxy classes. The company instead updated documentation rather than releasing a framework fix.
Barracuda and Ivanti issued fixes for their affected products, with the flaws tracked as CVE-2025-34392 for Barracuda Service Center RMM and CVE-2025-13659 for Ivanti Endpoint Manager. These vendor patches addressed product-level exposure stemming from the broader .NET behavior.
Researchers demonstrated exploitation paths against products including Barracuda Service Center RMM, Ivanti Endpoint Manager, Umbraco 8 CMS, Microsoft PowerShell, and SQL Server Integration Services, showing that rogue WSDL imports and proxy generation can lead to webshell upload or payload drops.
Security researchers, including Piotr Bazydło and watchTowr Labs, identified a design flaw in .NET Framework SOAP client proxy classes such as SoapHttpClientProtocol that allows attacker-controlled URLs to trigger arbitrary file writes, NTLM relay, and possible remote code execution in affected applications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcego.theregister.com
Open sourcelabs.watchtowr.com
Open sourcethehackernews.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
.NET Remoting, a deprecated remote invocation technology still embedded in some enterprise software, remains vulnerable to serious exploitation paths that can lead to **remote code execution**, arbitrary file read/write, and broader host compromise. Research from CODE WHITE and James Forshaw shows that insecure use of `BinaryFormatter` and `SoapFormatter`, weak protections across HTTP, TCP, and IPC remoting channels, and unsafe handling of `MarshalByRefObject` and `ObjRef` data can let attackers trigger deserialization abuse and even force outbound remoting connections. The reports warn that these weaknesses are architectural rather than isolated implementation bugs, leaving legacy deployments exposed even on supported .NET Framework versions. Forshaw's earlier work also demonstrated a **Low Type Filter** bypass that can still work against fully updated `.NET Framework 4.8` remoting services, enabling attackers who know the server URI and can meet any authentication requirements to access files and potentially bootstrap command execution. Public proof-of-concept tooling, including `ExploitRemotingService` and newer offensive additions such as an `ObjRef` gadget and a rogue remoting server, now supports exploitation over TCP and Windows IPC named pipes with functions such as command execution, file upload/download, directory listing, and assembly execution. The combined findings reinforce that organizations should treat exposed or internally reachable .NET Remoting services as high risk and migrate away from the technology.
Aug 1, 2026
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026