Loading story…
Microsoft disclosed CVE-2026-34339, an Important denial-of-service flaw in Windows Lightweight Directory Access Protocol (LDAP) caused by a NULL pointer dereference. The company said an authorized local attacker with low privileges could trigger the bug without user interaction, causing a loss of availability but not affecting confidentiality or integrity. Microsoft assigned the issue a CVSS 3.1 score of 5.5, said exploitation is considered less likely, and reported no public disclosure or active exploitation at publication; a vendor fix is available.
Microsoft also published CVE-2026-29169, a denial-of-service vulnerability affecting Apache HTTP Server mod_dav_lock through an indirect lock crash tied to CWE-476 NULL Pointer Dereference. That flaw carries a CVSS 3.1 score of 7.5 and is rated remotely exploitable over the network with no privileges or user interaction required, again impacting availability rather than confidentiality or integrity. The disclosures follow earlier Microsoft advisories for Windows denial-of-service issues including CVE-2024-49113 and CVE-2024-49121 in LDAP and CVE-2025-59259 in the Windows Local Session Manager.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-34339, a Windows Lightweight Directory Access Protocol denial-of-service vulnerability caused by a null pointer dereference. The company rated it Important with a CVSS 3.1 score of 5.5, said exploitation was less likely with no public exploitation reported, and made an official fix available.
Microsoft's Security Update Guide published CVE-2026-29169, describing a remotely exploitable NULL pointer dereference in Apache HTTP Server's mod_dav_lock that can cause denial of service. The advisory assigned a CVSS 3.1 score of 7.5 and noted no privileges or user interaction are required.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a broad set of **denial-of-service** vulnerabilities affecting Windows components and related software, including **IP Helper** (`CVE-2025-21231`), **Windows Virtual Trusted Platform Module** (`CVE-2025-21280`), **Windows Remote Desktop Services** (`CVE-2025-21330`), **DHCP Client Service** (`CVE-2025-21179`), **Windows Active Directory Domain Services API** (`CVE-2025-21351`), **Windows Hyper-V** (`CVE-2025-62567`), **Windows Kerberos** (`CVE-2022-41053`), and **Microsoft Defender** (`CVE-2023-36010`). The disclosures indicate continued exposure of core enterprise infrastructure services to attacks that can disrupt availability without necessarily compromising data or system integrity. Microsoft also issued an advisory for **Prometheus** remote read endpoint vulnerability `CVE-2026-42154`, describing a remotely exploitable flaw caused by a crafted **snappy** payload that can trigger uncontrolled resource consumption. Microsoft rated the issue **CVSS 7.5** and said it requires **no privileges** and **no user interaction**, with impact focused on sustained or persistent service outages. Together, the advisories highlight availability risks spanning identity, networking, virtualization, endpoint protection, remote access, and monitoring systems commonly deployed in enterprise environments.
Jun 29, 2026
Microsoft published security advisories for two Windows denial-of-service vulnerabilities affecting core platform components: **CVE-2025-21350** in **Windows Kerberos** and **CVE-2025-59198** in the **Windows Search Service**. The flaws were listed in the Microsoft Security Response Center's Security Update Guide as separate issues impacting authentication and search functionality within Windows environments. The advisories provide official tracking and patch guidance for organizations running affected Windows systems, highlighting the risk that attackers could disrupt service availability rather than execute code or elevate privileges. Security teams should review the relevant MSRC entries, determine exposure across domain-connected and endpoint systems, and prioritize remediation for assets that rely heavily on Kerberos authentication or Windows Search operations.
Jul 12, 2026
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026