Loading story…
Microsoft disclosed critical vulnerabilities in the Windows RPCSS service used for DCOM activation, including buffer overruns that let remote attackers send malformed RPC messages and execute arbitrary code with Local System privileges. The flaws affected Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, and Microsoft said the updated fix in MS03-039 superseded earlier patches from MS03-026 and MS01-048 while also addressing a denial-of-service issue in the same component.
Security researchers and network defenders reported that the DCOM-related RPC weakness, primarily exposed over TCP/UDP 135, was already being scanned and exploited in the wild, with underground exploit code in circulation and additional concern around TCP 593 and COM Internet Services exposure. Microsoft and ISS urged organizations to deploy the patch immediately and reduce exposure by filtering affected RPC/DCOM ports, disabling COM Internet Services and RPC over HTTP where possible, using host firewalls or IPsec filters, and disabling DCOM on systems that did not require it.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published Security Bulletin MS03-039 disclosing three vulnerabilities in the Windows RPCSS component that handles DCOM activation, including two critical buffer overruns enabling remote code execution and one denial-of-service flaw. The bulletin rated the issue Critical for affected Windows versions, said the update superseded MS03-026 and MS01-048, and recommended immediate deployment.
Internet Security Systems reported a buffer overflow in the Microsoft Windows RPC service affecting the DCOM interface, primarily exposed on port 135. ISS said exploit code was already circulating and that widespread scanning and exploitation had been observed against affected Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **critical remote code execution vulnerabilities** in the Windows RPC Runtime, including **`CVE-2022-26809`**, a flaw in `rpcrt4.dll` that could allow **unauthenticated, zero-click code execution** on vulnerable systems. Security reporting said the bug stemmed from an integer overflow that could lead to a heap buffer overflow during RPC processing, affecting both client-side and server-side code paths in Windows. Researchers warned that unpatched systems exposing **TCP port `445`** were at particular risk, with internet scanning indicating that **more than 700,000** Windows machines could be reachable and potentially vulnerable. Microsoft’s April security updates addressed the issue, while defenders were urged to **apply patches**, **block external access to port `445`**, and **restrict inbound connections** to reduce exposure.
Aug 6, 2026
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
Microsoft published security advisories for multiple remote code execution vulnerabilities affecting **Remote Desktop Client**, **Remote Desktop Protocol**, and the **Remote Procedure Call (RPC) Runtime**. The referenced issues include `CVE-2025-58718` in the Remote Desktop Client, alongside earlier Microsoft advisories for `CVE-2022-21851` in the Remote Desktop Client, `CVE-2022-21893` in Remote Desktop Protocol, and `CVE-2022-21922` in the RPC Runtime. The advisories indicate continued security risk around core Windows remote access and interprocess communication components that are widely used in enterprise environments. For defenders, the common thread is exposure to **remote code execution** in services and clients tied to remote connectivity, making Microsoft’s security updates for these CVEs a priority for systems that rely on RDP and RPC functionality.
Jul 12, 2026