Loading story…
SafeBreach Labs disclosed CVE-2025-29969, a Windows vulnerability in the MS-EVEN (EventLog) RPC protocol that allowed a low-privileged domain user to achieve remote code execution across an Active Directory network. The attack targeted the default-enabled EventLog service over the named pipe \PIPE\eventlog, where researchers found primitives for remote file and directory existence checks based on differing error codes, as well as a way to write files remotely by abusing the ElfrOpenBELW and ElfrBackupELFW functions.
The exploit chain relied on a time-of-check/time-of-use (TOCTOU) flaw: a benign .evtx header was validated when a remote SMB-hosted file was opened, then the file contents were swapped before backup so arbitrary content could be written to a chosen path on the target system. SafeBreach demonstrated code execution by placing a batch file in a user Startup folder and by writing a malicious DLL for a per-user OneDrive DLL hijack. Microsoft was notified in February 2025 and patched the RCE path in May 2025, although the researchers said some reconnaissance-style behaviors, including remote existence checks and related information-gathering capabilities, remain unpatched.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft patched CVE-2025-29969 in May 2025. According to SafeBreach, the patch addressed the TOCTOU-based remote code execution technique, while some recon-style behaviors remained unpatched.
SafeBreach reported CVE-2025-29969 to Microsoft after discovering an Active Directory domain-network RCE chain involving the Windows EventLog RPC interface. The issue allowed low-privileged remote interaction that could be abused for remote file checks and arbitrary file writes leading to code execution.
SafeBreach publicly disclosed technical details of CVE-2025-29969, describing exploitation of the MS-EVEN EventLog protocol over the \PIPE\eventlog named pipe. The write-up included the remote file-write primitive, the TOCTOU exploitation method, and demonstrated code execution scenarios involving a Startup folder batch file and a OneDrive DLL hijack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
A critical Windows Netlogon remote code execution flaw, tracked as **`CVE-2026-41089`**, is being actively exploited against corporate networks, with attacks targeting Windows Server domain controllers. The vulnerability can be triggered through specially crafted Netlogon requests without authentication or user interaction, potentially allowing attackers to run arbitrary code with **SYSTEM-level privileges** and escalate to full domain compromise. Microsoft patched the issue in its May 2026 Patch Tuesday release, which addressed **118 vulnerabilities**, including **16 critical** flaws, and the **Centre for Cybersecurity Belgium** flagged the Netlogon bug as a priority because of confirmed in-the-wild exploitation. Organizations are being urged to immediately patch supported Windows Server versions from 2012 onward, restrict domain controllers from untrusted network exposure, and increase monitoring for suspicious Netlogon and authentication activity while reinforcing segmentation and access controls around domain controllers.
Jun 30, 2026
Multiple public write-ups detailed how Windows service and RPC design flaws enabled **local privilege escalation**, **sandbox escape**, and in some cases reliable code execution. Research on the Windows SSDP service linked `FC_BINDING_CONTEXT` misuse to **CVE-2025-48815**, showing that a context handle from one RPC interface could be passed into another interface expecting a different type and ultimately abused to call `CloseHandle` on an unintended handle. Separate analysis of the Windows telephony service described **CVE-2024-26230** as a use-after-free in `tapisrv` caused by improper ownership validation of RPC-managed objects, allowing a dangling pointer to be reclaimed with attacker-controlled data and steered toward `LoadLibraryW` despite **XFG** protections. Earlier Windows RPC research also covered Storage Service bugs **CVE-2019-0983** and **CVE-2019-0998**, where file-copy, directory, and ACL logic exposed through RPC could be abused to overwrite privileged files or alter their security descriptors. Other disclosures showed the same pattern across Windows subsystems. Analysis of **CVE-2022-22715** in `npfs.sys` demonstrated that malformed `LOCAL\` named pipe paths could trigger integer overflow and out-of-bounds kernel writes, enabling escape from the Adobe Reader **AppContainer** sandbox and escalation to kernel read/write. Research into **CVE-2021-1648** in `splwow64` described bypasses in printer-handle validation and an arbitrary address read, while older work on **CVE-2018-8550** examined COM `DfMarshal` abuse for elevation of privilege through privileged unmarshaling paths. Related reporting also highlighted Microsoft hard-link mitigations and a Citrix restricted-desktop breakout that relied on allowed scripting components rather than a zero-day, underscoring how weak validation, unsafe object handling, and incomplete execution controls repeatedly exposed high-impact privilege boundaries on Windows.
Aug 3, 2026