Loading story…
Microsoft published security guidance for CVE-2026-23303, an SMB client issue tied to cifs_set_cifscreds, and CVE-2026-23395, a Bluetooth flaw in the L2CAP protocol handler. The SMB vulnerability concerns plaintext credentials being logged, creating a risk that sensitive authentication data could be exposed through system logs and later harvested by attackers or administrators with log access.
The second issue affects Bluetooth L2CAP handling and involves acceptance of multiple L2CAP_ECRED_CONN_REQ requests, indicating a protocol-processing weakness in connection setup. Together, the advisories show Microsoft addressing both credential exposure and wireless protocol attack surface in its security updates, with organizations expected to review affected systems and apply the relevant patches through the Microsoft Security Update Guide.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-23395 to its Security Update Guide, describing a Bluetooth L2CAP issue related to accepting multiple L2CAP_ECRED_CONN_REQ requests.
Microsoft added CVE-2026-23303 to its Security Update Guide, describing an SMB client issue involving plaintext credentials being logged in cifs_set_cifscreds.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft published Security Update Guide advisories for multiple **Windows elevation-of-privilege (EoP)** vulnerabilities, including two affecting **Windows SMB Server** (**CVE-2026-24294** and **CVE-2026-26128**) and one affecting **Windows Projected File System (ProjFS)** (**CVE-2026-24290**). The SMB Server issues are associated with **CWE-287 (Improper Authentication)**, while the ProjFS issue is associated with **CWE-284 (Improper Access Control)**; all are rated **Important** with Microsoft-provided **CVSS v3.1** vectors indicating **local** exploitation conditions (e.g., `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Across the advisories, Microsoft’s scoring indicates an attacker would need **existing local access and low privileges** (`PR:L`) to exploit the flaws, with potential for **high impact to confidentiality, integrity, and availability** (`C:H/I:H/A:H`) if successfully leveraged for privilege escalation. One entry for **CVE-2026-24294** appears twice (a duplicate URL variant), but it describes the same SMB Server EoP vulnerability and does not add distinct technical details beyond the core advisory metadata (severity, weakness class, and CVSS vector).
Jul 12, 2026
Microsoft released its September 2025 Patch Tuesday updates to address **81 vulnerabilities** across its product portfolio, including **8 critical** flaws, **72 important** issues, and one vulnerability without a severity rating. The release included fixes for two vulnerabilities that were already being actively exploited in the wild, prompting calls for immediate patching. One of the exploited flaws, **`CVE-2025-55234`**, affects the **SMB Server** component and enables privilege escalation through relay attack techniques that can capture authentication data for unauthorized access. The second, **`CVE-2024-21907`**, affects versions earlier than **`13.0.1`** of the third-party **Newtonsoft.Json** library bundled with **Microsoft SQL Server** and can be exploited remotely without authentication to trigger a denial of service via a `StackOverflow` exception in `JsonConvert.DeserializeObject`. Microsoft also advised defenders to enable **SMB Server Signing** and **SMB Server Extended Protection for Authentication** as mitigations for the SMB issue, while warning that older devices may face compatibility problems.
Jul 24, 2026