Loading story…
Microsoft published security advisories for multiple vulnerabilities, including CVE-2026-40622, described as another "ghost domain names" attack variant, and CVE-2025-14524, which involves a bearer token leak on cross-protocol redirect. The disclosures indicate risks tied to identity, authentication, and trust boundaries, where attackers could potentially abuse domain-related conditions or redirect behavior to expose sensitive tokens.
The referenced advisories also include CVE-2022-21123, an Intel issue tracked by Microsoft as Shared Buffers Data Read (SBDR), highlighting continued visibility into hardware-level data exposure alongside software and cloud security flaws. Together, the notices show Microsoft updating customers on a mix of domain abuse, token leakage, and processor data-read vulnerabilities that could affect enterprise environments if left unpatched or unmitigated.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-40622, describing it as another 'ghost domain names' attack variant.
Microsoft published a Security Update Guide entry for CVE-2025-14524, described as a bearer token leak on cross-protocol redirect.
Microsoft listed CVE-2022-21123 in its Security Update Guide, describing it as an Intel Shared Buffers Data Read (SBDR) issue.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a broad set of **denial-of-service** vulnerabilities affecting Windows components and related software, including **IP Helper** (`CVE-2025-21231`), **Windows Virtual Trusted Platform Module** (`CVE-2025-21280`), **Windows Remote Desktop Services** (`CVE-2025-21330`), **DHCP Client Service** (`CVE-2025-21179`), **Windows Active Directory Domain Services API** (`CVE-2025-21351`), **Windows Hyper-V** (`CVE-2025-62567`), **Windows Kerberos** (`CVE-2022-41053`), and **Microsoft Defender** (`CVE-2023-36010`). The disclosures indicate continued exposure of core enterprise infrastructure services to attacks that can disrupt availability without necessarily compromising data or system integrity. Microsoft also issued an advisory for **Prometheus** remote read endpoint vulnerability `CVE-2026-42154`, describing a remotely exploitable flaw caused by a crafted **snappy** payload that can trigger uncontrolled resource consumption. Microsoft rated the issue **CVSS 7.5** and said it requires **no privileges** and **no user interaction**, with impact focused on sustained or persistent service outages. Together, the advisories highlight availability risks spanning identity, networking, virtualization, endpoint protection, remote access, and monitoring systems commonly deployed in enterprise environments.
Jun 29, 2026
Microsoft published security advisories for several Windows **information disclosure** flaws affecting core services and components, including the **Windows CSC Service** (`CVE-2025-21374`), **WLAN AutoConfig Service** (`CVE-2025-21257`), **Storage Management Provider** (`CVE-2025-33055`, `CVE-2025-33062`, `CVE-2025-55325`), and **Cryptographic Services** (`CVE-2025-58720`). The advisories indicate that sensitive information could be exposed through weaknesses in widely deployed Windows functionality spanning storage, networking, and cryptographic operations. The disclosures also align with Microsoft's earlier reporting on a similar **Windows iSCSI Target Service Information Disclosure Vulnerability** tracked as `CVE-2023-24945`, underscoring a recurring class of exposure issues across Windows services. While the referenced entries provide limited public technical detail, the breadth of affected components suggests defenders should prioritize Microsoft security updates and review systems that rely on these services for potential exposure to unintended data leakage.
Jul 12, 2026
Microsoft published security advisories for several **Windows spoofing vulnerabilities** affecting core platform components, including **Windows Shell Link Processing** (`CVE-2026-25185`), **Windows SMB Server** (`CVE-2025-48802`), **Windows NTLM** (`CVE-2025-21217`), **Virtual Secure Mode** (`CVE-2025-48813`), and **Windows Certificate** handling (`CVE-2022-21836`). The flaws span identity, file handling, network services, virtualization-backed security, and certificate trust mechanisms, indicating broad exposure across enterprise Windows environments. The advisories identify spoofing as the common impact, a class of weakness that can let attackers misrepresent files, systems, identities, or trust relationships to users and services. Organizations relying on Windows authentication, SMB-based file sharing, shortcut handling, certificate validation, and virtualization-based protections should review the affected CVEs and apply Microsoft security updates to reduce the risk of impersonation, deceptive content delivery, and trust bypass in managed environments.
Jul 12, 2026