Loading story…
Microsoft published a security advisory for CVE-2026-40379, a spoofing vulnerability affecting Microsoft Enterprise Security Token Service (ESTS). The flaw is listed in the Microsoft Security Update Guide as an ESTS spoofing issue, indicating a weakness that could allow an attacker to impersonate a trusted identity or service within authentication workflows tied to Microsoft's enterprise token infrastructure.
Public details remain limited, and the advisory entries do not include a technical synopsis, exploitation guidance, or mitigation specifics beyond the vulnerability classification. Even so, the disclosure puts defenders on notice because ESTS underpins identity and token issuance in Microsoft environments, making spoofing risks potentially significant for organizations that rely on Microsoft authentication and access control services.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-40379, a Microsoft Enterprise Security Token Service (ESTS) spoofing vulnerability, to its Security Update Guide. The provided references indicate public disclosure via Microsoft's advisory on this date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **Windows spoofing vulnerabilities** affecting core platform components, including **Windows Shell Link Processing** (`CVE-2026-25185`), **Windows SMB Server** (`CVE-2025-48802`), **Windows NTLM** (`CVE-2025-21217`), **Virtual Secure Mode** (`CVE-2025-48813`), and **Windows Certificate** handling (`CVE-2022-21836`). The flaws span identity, file handling, network services, virtualization-backed security, and certificate trust mechanisms, indicating broad exposure across enterprise Windows environments. The advisories identify spoofing as the common impact, a class of weakness that can let attackers misrepresent files, systems, identities, or trust relationships to users and services. Organizations relying on Windows authentication, SMB-based file sharing, shortcut handling, certificate validation, and virtualization-based protections should review the affected CVEs and apply Microsoft security updates to reduce the risk of impersonation, deceptive content delivery, and trust bypass in managed environments.
Jul 12, 2026
Microsoft published security advisories for several spoofing vulnerabilities affecting **Microsoft Exchange Server** and **Microsoft OfficePlus**, identifying `CVE-2021-41350`, `CVE-2021-42305`, `CVE-2022-41078`, `CVE-2022-41079`, and `CVE-2025-55243`. The Exchange issues span multiple advisory releases and indicate a recurring class of flaws that could allow attackers to impersonate trusted senders, services, or content within enterprise messaging environments. The disclosures show Exchange Server as the primary affected platform, with four separate spoofing CVEs listed across 2021 and 2022, while a later advisory extends the same risk category to OfficePlus. Although the referenced notices provide limited public technical detail, the affected products are widely deployed in corporate communications workflows, making spoofing weaknesses operationally significant for phishing, fraud, and trust-boundary bypass scenarios until patches are applied.
Jul 12, 2026
Microsoft disclosed and patched several spoofing vulnerabilities across Windows and Exchange Server, including **NTLM hash disclosure** issues tracked as `CVE-2025-24996`, `CVE-2025-59185`, and `CVE-2025-59244`, a **Windows NTLM spoofing** flaw `CVE-2025-21217`, a **Windows Themes spoofing** bug `CVE-2025-21308`, a **Windows Shell Link Processing spoofing** issue `CVE-2026-25185`, and an older **Microsoft Exchange Server spoofing** vulnerability `CVE-2021-24085`. The advisories indicate a broad set of weaknesses that could let attackers disguise content or trigger credential exposure through trusted Windows components and enterprise messaging infrastructure. The concentration of flaws around NTLM and user-facing file handling highlights continued risk from spoofing paths that can mislead users or disclose authentication material. For defenders, the updates underscore the need to prioritize Microsoft security patches for systems handling Windows authentication, shell link processing, themes, and Exchange workloads, especially where NTLM remains enabled and could be leveraged for credential theft or follow-on intrusion.
Jul 12, 2026