Loading story…
Microsoft published security advisories for a series of vulnerabilities in Windows Routing and Remote Access Service (RRAS), including multiple remote code execution issues tracked as CVE-2024-49085, CVE-2024-49089, CVE-2025-21208, CVE-2025-33064, CVE-2025-49670, CVE-2025-49688, and CVE-2025-62549. The advisories indicate that RRAS, a Windows component used for routing and remote access functions, was affected repeatedly across several release cycles, with Microsoft issuing fixes through its Security Update Guide.
Microsoft also disclosed RRAS information disclosure flaws, including CVE-2025-53798 and CVE-2025-55700, showing that the service faced both code execution and data exposure risks. While the referenced entries provide little technical detail, the concentration of advisories around RRAS highlights the need for organizations using the service to prioritize Microsoft security updates, review RRAS exposure on internet-facing and internal systems, and verify that vulnerable Windows servers have been remediated.
See real exploitation activity before you spend the cycle.
25 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-25173, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2026-25172, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft added a Security Update Guide entry for CVE-2025-62549, a remote code execution vulnerability affecting Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-55700, describing an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-54113, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released on the same day as other RRAS vulnerability disclosures in September 2025.
Microsoft published a Security Update Guide entry for CVE-2025-54106, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released on the same day as other RRAS vulnerability disclosures in September 2025.
Microsoft published a Security Update Guide entry for CVE-2025-54095, identifying it as an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft added a Security Update Guide entry for CVE-2025-53798, an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-53796, identifying it as an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-53797, identifying it as an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-49753, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released as part of Microsoft's 2025-07-08 RRAS vulnerability disclosures.
Microsoft published a Security Update Guide entry for CVE-2025-47998, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released as part of Microsoft's 2025-07-08 RRAS vulnerability disclosures.
Microsoft published a Security Update Guide entry for CVE-2025-49729, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-49681, identifying it as an information disclosure vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-49672, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-49663, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released as part of Microsoft's 2025-07-08 RRAS vulnerability disclosures.
Microsoft published Security Update Guide entries for two additional Windows Routing and Remote Access Service remote code execution vulnerabilities, CVE-2025-49670 and CVE-2025-49688.
Microsoft published a Security Update Guide entry for CVE-2025-49668, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service. The advisory was released on the same day as other RRAS vulnerability disclosures in July 2025.
Microsoft published a Security Update Guide entry for CVE-2025-33066, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2025-33064, identifying it as a Windows Routing and Remote Access Service remote code execution vulnerability.
Microsoft added a Security Update Guide entry for CVE-2025-21208, a remote code execution vulnerability affecting Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2024-49104, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2024-49102, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published a Security Update Guide entry for CVE-2024-49086, identifying it as a remote code execution vulnerability in Windows Routing and Remote Access Service.
Microsoft published Security Update Guide entries for two Windows Routing and Remote Access Service remote code execution vulnerabilities, CVE-2024-49085 and CVE-2024-49089.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
31 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026
Microsoft published security advisories for a broad set of **remote code execution** vulnerabilities affecting Windows components and enterprise services, including **Windows Telephony Service**, **Hyper-V**, **ReFS**, **WSUS**, **Direct Show**, the **Windows Mobile Broadband Driver**, **Windows Server Setup and Boot Event Collection**, **SQL Server Native Client**, and **.NET**. The largest concentration of disclosures involved the Windows Telephony Service, with multiple CVEs including `CVE-2024-43620`, `CVE-2024-43627`, `CVE-2025-21190`, `CVE-2025-21240`, `CVE-2025-21243`, `CVE-2025-21250`, `CVE-2025-21266`, `CVE-2025-21273`, `CVE-2025-21409`, and `CVE-2025-21413`, indicating sustained patching activity around a single Windows attack surface. Other disclosed RCE issues expanded the risk to virtualization, storage, update infrastructure, and server environments through `CVE-2026-21244` and `CVE-2026-21248` in **Windows Hyper-V**, `CVE-2025-62456` in **Windows Resilient File System (ReFS)**, `CVE-2025-59287` in **Windows Server Update Service (WSUS)**, `CVE-2025-49666` in **Windows Server Setup and Boot Event Collection**, `CVE-2024-49012` in **SQL Server Native Client**, `CVE-2025-21291` in **Windows Direct Show**, and `CVE-2026-24288` in the **Windows Mobile Broadband Driver**. One referenced case, `CVE-2021-34458`, showed the potential severity of Microsoft RCE flaws in virtualized environments, with Microsoft describing a **Critical** Windows Kernel issue that could enable cross-guest interference on systems using **SR-IOV-capable hardware**.
Jun 29, 2026
Microsoft released fixes for two **Windows Remote Desktop Protocol (RDP)** information disclosure vulnerabilities, `CVE-2026-42908` and `CVE-2026-45639`, that allow a remote, unauthenticated attacker to trigger out-of-bounds reads and expose sensitive memory without user interaction. According to reporting on the June 9, 2026 security updates, `CVE-2026-42908` can disclose local memory addresses and weaken **ASLR**, while `CVE-2026-45639` can reveal process memory including credentials, session tokens, and protocol state data. Microsoft rated both flaws **Important** with **CVSS 7.5** and said exploitation was considered less likely at release, with no public exploits reported. The vulnerabilities affect a broad set of Windows platforms, including **Windows 10**, **Windows 11**, **Windows Server 2012 through 2025**, and Microsoft’s Remote Desktop client offerings for Windows desktop. The disclosures arrive amid continued scrutiny of the RDP ecosystem after earlier reports of severe Remote Desktop weaknesses, including `CVE-2025-29967` in **RD Gateway** and `CVE-2025-29966` and `CVE-2025-48817` in the **Windows Remote Desktop Client**, which were described as enabling remote code execution through heap overflow or path traversal conditions. Organizations were urged to prioritize patching internet-exposed RDP systems and strengthen access controls with VPNs, bastion hosts, strong authentication, and monitoring.
Jun 29, 2026