Loading story…
Microsoft disclosed and patched two remote code execution vulnerabilities in the Windows Pragmatic General Multicast (PGM) component, tracked as CVE-2023-28250 and CVE-2023-36397. Both issues were published through Microsoft's Security Update Guide and affect the Windows networking feature used for reliable multicast message delivery.
The advisories indicate that successful exploitation could allow code execution through the vulnerable PGM service, making exposed Windows systems a priority for patching. Organizations using Windows hosts with the PGM feature enabled should verify that security updates covering both CVEs have been applied and review asset exposure tied to the affected multicast service.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published security guidance for CVE-2023-36397, another remote code execution vulnerability affecting Windows Pragmatic General Multicast (PGM). The issue was disclosed in Microsoft's November 2023 security updates.
Microsoft published security guidance for CVE-2023-28250, a remote code execution vulnerability in Windows Pragmatic General Multicast (PGM). The advisory indicates the vulnerability was publicly disclosed as part of Microsoft's April 2023 security updates.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
portal.msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for two **Windows Point-to-Point Tunneling Protocol (PPTP)** remote code execution vulnerabilities, tracked as **`CVE-2022-41039`** and **`CVE-2022-41088`**. Both issues affect the Windows implementation of PPTP, a legacy VPN tunneling protocol, and were published through Microsoft's Security Update Guide as separate advisories. The paired disclosures indicate that attackers could potentially exploit weaknesses in the PPTP component to execute code on affected Windows systems, making patching a priority for organizations that still expose or rely on PPTP services. Security teams should identify systems with PPTP enabled, apply Microsoft's fixes for both CVEs, and review whether continued use of PPTP is necessary given its age and security history.
Jul 12, 2026
Microsoft published security advisories for a broad set of **remote code execution** vulnerabilities affecting Windows components and enterprise services, including **Windows Telephony Service**, **Hyper-V**, **ReFS**, **WSUS**, **Direct Show**, the **Windows Mobile Broadband Driver**, **Windows Server Setup and Boot Event Collection**, **SQL Server Native Client**, and **.NET**. The largest concentration of disclosures involved the Windows Telephony Service, with multiple CVEs including `CVE-2024-43620`, `CVE-2024-43627`, `CVE-2025-21190`, `CVE-2025-21240`, `CVE-2025-21243`, `CVE-2025-21250`, `CVE-2025-21266`, `CVE-2025-21273`, `CVE-2025-21409`, and `CVE-2025-21413`, indicating sustained patching activity around a single Windows attack surface. Other disclosed RCE issues expanded the risk to virtualization, storage, update infrastructure, and server environments through `CVE-2026-21244` and `CVE-2026-21248` in **Windows Hyper-V**, `CVE-2025-62456` in **Windows Resilient File System (ReFS)**, `CVE-2025-59287` in **Windows Server Update Service (WSUS)**, `CVE-2025-49666` in **Windows Server Setup and Boot Event Collection**, `CVE-2024-49012` in **SQL Server Native Client**, `CVE-2025-21291` in **Windows Direct Show**, and `CVE-2026-24288` in the **Windows Mobile Broadband Driver**. One referenced case, `CVE-2021-34458`, showed the potential severity of Microsoft RCE flaws in virtualized environments, with Microsoft describing a **Critical** Windows Kernel issue that could enable cross-guest interference on systems using **SR-IOV-capable hardware**.
Jun 29, 2026
Microsoft published security updates for several **Windows elevation of privilege** vulnerabilities affecting core components including **Win32k** (`CVE-2024-30082`, `CVE-2023-36743`), **Microsoft COM for Windows** (`CVE-2025-21281`), the **Microsoft Graphics Component** (`CVE-2025-49708`), and the **Windows Search Service** (`CVE-2026-27909`). The advisories indicate that successful exploitation could allow an attacker to gain higher privileges on a targeted Windows system, increasing the risk of broader compromise after initial access. The affected components span user interface, inter-process communication, graphics, and search functionality, showing continued exposure in widely deployed parts of the Windows platform. Microsoft issued entries for each CVE through its Security Update Guide, including both vulnerability and advisory records for `CVE-2025-21281`, and organizations should prioritize patching these flaws as part of routine Windows security maintenance because privilege escalation bugs are commonly chained with other exploits to obtain **SYSTEM**-level or administrative control.
Jul 12, 2026