Loading story…
Microsoft published security advisories for several vulnerabilities affecting Windows Virtualization-Based Security (VBS) and VBS Enclave components, including elevation-of-privilege issues tracked as CVE-2025-48803, CVE-2025-48811, and CVE-2025-53717. The advisories indicate that flaws in these protected execution and isolation features could allow an attacker to gain higher privileges on affected Windows systems.
Microsoft also disclosed CVE-2025-21340, a security feature bypass in Windows VBS, expanding the scope beyond privilege escalation to weaknesses that could undermine VBS protections themselves. Together, the advisories highlight repeated security issues in Windows virtualization-based isolation mechanisms and reinforce the need for organizations using VBS-backed protections to review affected systems and apply Microsoft updates.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2025-53717 to its Security Update Guide as a Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege vulnerability.
Microsoft published Security Update Guide entries for two Windows Virtualization-Based Security vulnerabilities: CVE-2025-48803, an elevation of privilege flaw, and CVE-2025-48811, a VBS Enclave elevation of privilege flaw.
Microsoft added CVE-2025-21340 to its Security Update Guide as a Windows Virtualization-Based Security (VBS) Security Feature Bypass vulnerability.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed two elevation-of-privilege vulnerabilities affecting **Windows Virtualization-Based Security (VBS)**, including **CVE-2025-47159** and **CVE-2025-21370**. The issues impact VBS components designed to harden Windows by isolating sensitive processes and security functions from the rest of the operating system. One of the flaws specifically affects **VBS Enclaves**, while the other targets VBS more broadly, indicating that protected execution environments within Windows can still present privilege-escalation risk if not patched. Microsoft published both entries through its Security Update Guide, signaling that organizations relying on VBS-backed protections should prioritize remediation and review exposure across systems using these security features.
Jun 29, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026