Loading story…
Microsoft disclosed and patched several remote code execution vulnerabilities in Microsoft Digest Authentication, including CVE-2025-21368, CVE-2025-21369, and the earlier CVE-2025-21294. The flaws were published through the Microsoft Security Response Center update guide, which identifies each issue as affecting the Digest Authentication component and carrying remote code execution impact.
The advisories indicate a cluster of related weaknesses in the same Microsoft authentication technology rather than a single isolated bug, expanding the number of tracked CVEs tied to the component. Organizations using systems that rely on Microsoft Digest Authentication should review the corresponding MSRC entries and prioritize vendor security updates for all affected products to reduce exposure to potential code execution attacks.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2025-21369, identifying it as a Microsoft Digest Authentication remote code execution vulnerability.
Microsoft published a Security Update Guide entry for CVE-2025-21368, identifying it as a Microsoft Digest Authentication remote code execution vulnerability.
Microsoft published a Security Update Guide entry for CVE-2025-21294, identifying it as a Microsoft Digest Authentication remote code execution vulnerability.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its January 2025 security updates to fix **161 vulnerabilities** across its product portfolio, including **58 remote code execution** flaws and **12 critical** issues. The update covers high-risk weaknesses in **Windows OLE**, **Windows RMCAST**, **Windows NTLM v1**, **Azure Marketplace SaaS Resources**, **Microsoft Purview**, **Microsoft Excel**, **Remote Desktop Services**, **Digest Authentication**, **NEGOEX**, and **BranchCache**, according to Microsoft’s release notes and CSIRT.SK. The most urgent issues are three **Windows Hyper-V NT Kernel Integration VSP** privilege-escalation vulnerabilities — `CVE-2025-21333`, `CVE-2025-21334`, and `CVE-2025-21335` — which were reported as **actively exploited in the wild**. Defenders were urged to deploy the January patch bundle quickly, with additional mitigations noted for some exposures, including using plaintext mode in Outlook, restricting exposed PGM ports, and disabling **NTLMv1** by setting `LmCompatibilityLevel` to `5`.
Jul 24, 2026
Microsoft published security advisories for a broad set of **remote code execution** vulnerabilities affecting Windows components and enterprise services, including **Windows Telephony Service**, **Hyper-V**, **ReFS**, **WSUS**, **Direct Show**, the **Windows Mobile Broadband Driver**, **Windows Server Setup and Boot Event Collection**, **SQL Server Native Client**, and **.NET**. The largest concentration of disclosures involved the Windows Telephony Service, with multiple CVEs including `CVE-2024-43620`, `CVE-2024-43627`, `CVE-2025-21190`, `CVE-2025-21240`, `CVE-2025-21243`, `CVE-2025-21250`, `CVE-2025-21266`, `CVE-2025-21273`, `CVE-2025-21409`, and `CVE-2025-21413`, indicating sustained patching activity around a single Windows attack surface. Other disclosed RCE issues expanded the risk to virtualization, storage, update infrastructure, and server environments through `CVE-2026-21244` and `CVE-2026-21248` in **Windows Hyper-V**, `CVE-2025-62456` in **Windows Resilient File System (ReFS)**, `CVE-2025-59287` in **Windows Server Update Service (WSUS)**, `CVE-2025-49666` in **Windows Server Setup and Boot Event Collection**, `CVE-2024-49012` in **SQL Server Native Client**, `CVE-2025-21291` in **Windows Direct Show**, and `CVE-2026-24288` in the **Windows Mobile Broadband Driver**. One referenced case, `CVE-2021-34458`, showed the potential severity of Microsoft RCE flaws in virtualized environments, with Microsoft describing a **Critical** Windows Kernel issue that could enable cross-guest interference on systems using **SR-IOV-capable hardware**.
Jun 29, 2026
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting **Exchange Server** and **SharePoint Server**, including Exchange flaws tracked as `CVE-2023-21706`, `CVE-2023-28310`, and `CVE-2023-36439`, alongside SharePoint issues `CVE-2026-33110`, `CVE-2026-33112`, and `CVE-2026-40368`. The SharePoint vulnerabilities were tied to **deserialization of untrusted data** and were rated **Important**, with CVSS scores of **8.8** for `CVE-2026-33110` and `CVE-2026-33112`, and **8.0** for `CVE-2026-40368`. Microsoft said `CVE-2026-33110` could let an authenticated attacker with at least **Site Member** permissions execute code remotely on a vulnerable SharePoint Server, while `CVE-2026-33112` required at least **Site Owner** privileges to inject and run arbitrary code. For `CVE-2026-40368`, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were **not publicly disclosed** and **not exploited in the wild** at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**.
Jun 29, 2026