Loading story…
Microsoft disclosed several Windows Simple Search and Discovery Protocol (SSDP) Service elevation-of-privilege vulnerabilities, including CVE-2026-32082, CVE-2025-48815, CVE-2025-47975, and CVE-2025-59196, indicating a recurring security issue affecting the Windows SSDP component. The advisories identify the flaws as local privilege-escalation bugs that could allow an attacker with existing low-privilege access to gain administrator-level rights on a vulnerable system.
For CVE-2026-32082, Microsoft said the issue stems from a race condition (CWE-362) and rated it Important with a CVSS 3.1 score of 7.0. The company described exploitation as requiring local access and low privileges, with high impact to confidentiality, integrity, and availability if successful. Microsoft said exploitation was considered less likely, was not publicly disclosed or known to be exploited at publication, and that a security update was available.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-32083 in the Windows Simple Search and Discovery Protocol (SSDP) Service via its Security Update Guide. The publication indicates an official fix was released for this separate elevation-of-privilege vulnerability.
Microsoft disclosed CVE-2026-32082 as an Important Windows SSDP Service elevation-of-privilege flaw caused by a race condition (CWE-362). The company said a low-privileged local attacker could gain administrator privileges, exploitation was less likely, there was no evidence of public disclosure or in-the-wild exploitation, and an official fix was available.
Microsoft disclosed CVE-2026-32068 in the Windows Simple Search and Discovery Protocol (SSDP) Service through its Security Update Guide. The publication indicates an official fix was released for this separate elevation-of-privilege vulnerability.
Microsoft published a Security Update Guide entry for CVE-2025-59196, an elevation-of-privilege vulnerability in the Windows Simple Search and Discovery Protocol (SSDP) Service.
Microsoft published a Security Update Guide entry for CVE-2025-48815, another elevation-of-privilege vulnerability affecting the Windows Simple Search and Discovery Protocol (SSDP) Service.
Microsoft published a Security Update Guide entry for CVE-2025-47975, an elevation-of-privilege vulnerability affecting the Windows Simple Search and Discovery Protocol (SSDP) Service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft disclosed and patched multiple **elevation-of-privilege vulnerabilities** in the **Windows Common Log File System (CLFS) Driver**, including `CVE-2026-40407`, `CVE-2025-62470`, and `CVE-2025-32713`. The most detailed advisory, for `CVE-2026-40407`, describes a **heap-based buffer overflow** (`CWE-122`) that allows a locally authenticated low-privilege attacker to escalate to **SYSTEM** without user interaction. Microsoft rated `CVE-2026-40407` as **Important** with a **CVSS 3.1 score of 7.8**, citing **high** impact to confidentiality, integrity, and availability. The company said the flaw had **not** been publicly disclosed and was **not** being exploited in the wild at the time of publication, assessed exploitation as unlikely, and released an official security update to remediate the issue; the related CLFS advisories indicate a continuing pattern of privilege-escalation risk in this Windows component.
Jul 12, 2026
Microsoft published security updates for several Windows elevation of privilege vulnerabilities affecting core components, including **Windows Storage Spaces Controller**, **Windows SMB Client**, and **Windows Speech Runtime**. The issues were tracked as `CVE-2026-27907`, `CVE-2025-32718`, and `CVE-2025-58715`, respectively, and all could allow attackers to gain higher privileges on affected systems after initial access. Among the disclosed flaws, Microsoft provided the most detail for `CVE-2026-27907`, describing it as an **integer underflow** issue (`CWE-191`) in Windows Storage Spaces Controller that could let a locally authenticated low-privileged attacker elevate privileges to **SYSTEM** without user interaction. Microsoft rated that vulnerability **Important** with a **CVSS 3.1 score of 7.8**, said it was not publicly disclosed or exploited at publication, assessed exploitation as less likely, and released an official fix as part of its security guidance.
Jun 29, 2026