Loading story…
Microsoft published security advisories for several remote code execution vulnerabilities affecting core Windows networking and productivity components, including Layer 2 Tunneling Protocol (L2TP) flaws tracked as CVE-2023-41765, CVE-2023-41770, and CVE-2023-41773, a Windows Remote Desktop Services issue tracked as CVE-2025-21297, and a Microsoft Office vulnerability tracked as CVE-2026-40358. The advisories indicate that the affected attack surfaces span remote access, tunneling, and document-handling functionality, increasing the importance of patching internet-exposed and user-facing systems.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published guidance for CVE-2026-40358, a critical Microsoft Office use-after-free vulnerability that can lead to remote code execution. Microsoft said exploitation was less likely, there was no evidence of public disclosure or in-the-wild exploitation at publication, and an official fix was available.
Microsoft published a Security Update Guide entry for CVE-2025-21297, a Windows Remote Desktop Services remote code execution vulnerability. The reference indicates public disclosure of the flaw and associated guidance on the publication date.
Microsoft published Security Update Guide entries for CVE-2023-41765, CVE-2023-41770, and CVE-2023-41773, all described as Layer 2 Tunneling Protocol remote code execution vulnerabilities. The advisories indicate the vulnerabilities were disclosed with updates available on the same day.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026
Microsoft published security advisories for multiple remote code execution vulnerabilities affecting **Remote Desktop Client**, **Remote Desktop Protocol**, and the **Remote Procedure Call (RPC) Runtime**. The referenced issues include `CVE-2025-58718` in the Remote Desktop Client, alongside earlier Microsoft advisories for `CVE-2022-21851` in the Remote Desktop Client, `CVE-2022-21893` in Remote Desktop Protocol, and `CVE-2022-21922` in the RPC Runtime. The advisories indicate continued security risk around core Windows remote access and interprocess communication components that are widely used in enterprise environments. For defenders, the common thread is exposure to **remote code execution** in services and clients tied to remote connectivity, making Microsoft’s security updates for these CVEs a priority for systems that rely on RDP and RPC functionality.
Jul 12, 2026
Microsoft published security advisories for several **remote code execution** vulnerabilities affecting **Microsoft Office** and **Microsoft Excel**, including `CVE-2025-24057`, `CVE-2025-24075`, and `CVE-2025-47162`. The issues were listed in the Microsoft Security Update Guide as Office-family flaws that could allow arbitrary code execution if successfully exploited. The disclosures indicate that the affected attack surface spans both the broader Office suite and Excel specifically, underscoring continued risk from malicious documents and content processed by productivity software. Organizations using Microsoft Office should prioritize review of the relevant advisories and deployment of associated security updates for the affected products tied to these CVEs.
Jul 12, 2026