Loading story…
Microsoft’s early-2026 patch cycle drew heightened attention after the company issued an out-of-band security update for CVE-2026-21509, a Microsoft Office security feature bypass vulnerability, signaling elevated threat conditions and a need for rapid patch deployment. Threat-intelligence reporting emphasized that attacker interest often accelerates immediately after Patch Tuesday as defenders race to remediate, and it prioritized vulnerabilities most likely to be weaponized based on factors such as known exploitation, public disclosure, criticality, and Microsoft’s exploitability assessments.
Separate executive-focused coverage highlighted the broader operational challenge of CVE volume growth and the need for CISOs to triage “signal vs. noise” in vulnerability management, including attention to Patch Tuesday items described as actively exploited. However, one referenced CSO Online page is primarily an opinion piece on purple teaming and functions largely as a navigation hub to other stories rather than providing substantive details on the Office out-of-band vulnerability or a single, specific exploitation event.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
BeyondTrust released a fix for a critical remote code execution vulnerability affecting its remote access tools. The remediation was highlighted in February 2026 security news coverage.
Microsoft's February 2026 Patch Tuesday addressed six new vulnerabilities that were already being actively exploited. This was highlighted in contemporaneous coverage as a notable remediation event.
CERT-UA reported limited in-the-wild exploitation of CVE-2026-21509 in attacks using a malicious Office document, WebDAV retrieval, DLL and shellcode deployment, COM hijacking, a scheduled task, and COVENANT C2 via Filen. The activity was attributed to APT28.
On January 26, 2026, Microsoft released an out-of-band patch for CVE-2026-21509, a Microsoft Office security feature bypass vulnerability. The flaw stood out as the most significant issue associated with the January patch cycle.
Microsoft issued its January 2026 Patch Tuesday security updates, including fixes for vulnerabilities such as CVE-2026-20805 and multiple Office and Windows flaws. Reporting described the release as moderate in volume.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
flare.io
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft warned customers to expect a sustained rise in Windows security updates as it expands AI-assisted vulnerability discovery, then followed with unusually large Patch Tuesday releases that underscored the shift. The company said its multi-model agentic scanning harness, **MDASH**, is finding more flaws across the Windows codebase and is being paired with updates to Microsoft’s Secure Development Lifecycle to address AI-enabled attack paths while keeping human validation in the loop. External reporting and national CERT coverage highlighted the broader operational impact for defenders as vulnerability volume increases. The most dramatic release fixed **570 CVEs** in a record Patch Tuesday, including three zero-days and two that were exploited in the wild: `CVE-2026-56155` in **Active Directory Federation Services** and `CVE-2026-56164` in **Microsoft SharePoint Server**. Microsoft also patched the publicly disclosed `CVE-2026-50661` **BitLocker** security feature bypass, while the prior month’s update addressed **200 CVEs**, including the `CVE-2026-49160` **"HTTP/2 Bomb"** denial-of-service flaw, `CVE-2026-50507` in BitLocker, and `CVE-2026-45586`, a Windows elevation-of-privilege bug that could grant **SYSTEM** access. Security observers said the spike reflects AI-driven fuzzing, variant hunting, and large-scale static analysis, increasing pressure on organizations to prioritize asset inventory and risk-based patching.
Aug 17, 2026
Microsoft released its largest Patch Tuesday update to date, fixing **206 vulnerabilities** across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included **three publicly disclosed zero-days**, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw `CVE-2026-41091`. Publicly disclosed issues in the June bundle included `CVE-2026-50507`, a **BitLocker** security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and `CVE-2026-45586`, a **Windows CTFMON** elevation-of-privilege flaw that could let a low-privileged local attacker gain **SYSTEM** access. JPCERT/CC also warned that Microsoft disclosed active exploitation of `CVE-2026-42897`, a spoofing flaw in **Microsoft Exchange Server**.
Jul 3, 2026
Microsoft’s March 2026 Patch Tuesday shipped fixes for **79 vulnerabilities**, including **two zero-day flaws**. Public reporting and third-party patch reviews highlight a mix of *Important* and *Critical* issues across Microsoft’s ecosystem, including **.NET** (`CVE-2026-26127` DoS; `CVE-2026-26131` EoP), **Active Directory Domain Services** (`CVE-2026-25177` EoP), **ASP.NET Core** (`CVE-2026-26130` DoS), and multiple Azure components such as **ACI Confidential Containers** (`CVE-2026-23651`, `CVE-2026-26124` EoP; `CVE-2026-26122` information disclosure) and **Azure IoT Explorer** (`CVE-2026-26121` spoofing; `CVE-2026-23661/23662/23664` information disclosure). Independent analysis (ZDI and SANS ISC) corroborated the breadth of affected products and provided additional scoring/metadata, including CVSS ratings and exploitability flags. ZDI’s review also called out additional *Critical* items in the release such as **Microsoft Office RCE** (`CVE-2026-26110`, `CVE-2026-26113`) and other high-impact vulnerabilities, while SANS ISC’s Patch Tuesday coverage additionally noted bundled **Chromium**-tracked fixes (multiple `CVE-2026-3536` through `CVE-2026-3544` entries) that commonly map to Microsoft’s browser/embedded Chromium components. Organizations should prioritize patching systems exposed to untrusted content or authentication boundaries (e.g., Office, AD DS, Azure agents/extensions) and validate deployment coverage across both Windows and cloud-connected workloads.
Jun 29, 2026