Loading story…
Microsoft published security advisories for several remote code execution vulnerabilities affecting core Windows components and the OmniParser product. The issues include CVE-2024-21341 in the Windows Kernel, CVE-2024-30074 in the Windows Link Layer Topology Discovery Protocol, CVE-2024-49080 in the Windows IP Routing Management Snap-in, and CVE-2025-55322 in OmniParser, expanding the set of Microsoft-tracked flaws that could allow attackers to run arbitrary code on vulnerable systems.
The affected components span low-level operating system functionality, network discovery and routing management, and a separate Microsoft product, indicating exposure across both endpoint and administrative environments. Microsoft assigned each issue a formal Security Update Guide entry and released fixes through its advisory process, underscoring the need for organizations to review affected assets, prioritize patch deployment, and validate that Windows systems and OmniParser installations are updated against these RCE risks.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2025-55322, an OmniParser remote code execution vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-49080, a Windows IP Routing Management Snap-in remote code execution vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-30074, a Windows Link Layer Topology Discovery Protocol remote code execution vulnerability.
Microsoft released a Security Update Guide entry for CVE-2024-21341, a Windows Kernel remote code execution vulnerability.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published Security Update Guide entries for two Windows remote code execution vulnerabilities affecting different core components: **CVE-2022-41118** in **Windows Scripting Languages** and **CVE-2025-59295** in **Windows URL Parsing**. Both advisories classify the issues as remote code execution flaws, indicating that successful exploitation could allow an attacker to run arbitrary code on a targeted Windows system. The disclosures point to risk across widely used Windows functionality rather than a single application, underscoring the need for defenders to review affected product versions and apply Microsoft-issued updates through normal patch management channels. The vulnerabilities are tracked under the identifiers `CVE-2022-41118` and `CVE-2025-59295`, with Microsoft maintaining the authoritative remediation details in its Security Update Guide.
Jul 12, 2026
Microsoft released security updates addressing **79 vulnerabilities** across its product portfolio, including **19 remote code execution** flaws and several issues already under active exploitation. The most severe bug, **`CVE-2024-43491`**, is a **Windows Update** use-after-free vulnerability with a **CVSS 9.8** rating that can allow **unauthenticated remote code execution**. Critical vulnerabilities were also reported in **Microsoft SharePoint Server**, **Azure Web Apps**, **Azure Stack Hub**, and **Windows Network Address Translation**, expanding the risk beyond endpoint systems to server and cloud-connected environments. Microsoft and third-party reporting said attackers were already exploiting **`CVE-2024-38014`** in **Windows Installer**, **`CVE-2024-38217`** in **Mark of the Web**, **`CVE-2024-38226`** in **Microsoft Publisher**, and **`CVE-2024-43491`** in **Windows Update**. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Jul 24, 2026
Microsoft published security advisories for a broad set of **remote code execution** vulnerabilities affecting Windows components and enterprise services, including **Windows Telephony Service**, **Hyper-V**, **ReFS**, **WSUS**, **Direct Show**, the **Windows Mobile Broadband Driver**, **Windows Server Setup and Boot Event Collection**, **SQL Server Native Client**, and **.NET**. The largest concentration of disclosures involved the Windows Telephony Service, with multiple CVEs including `CVE-2024-43620`, `CVE-2024-43627`, `CVE-2025-21190`, `CVE-2025-21240`, `CVE-2025-21243`, `CVE-2025-21250`, `CVE-2025-21266`, `CVE-2025-21273`, `CVE-2025-21409`, and `CVE-2025-21413`, indicating sustained patching activity around a single Windows attack surface. Other disclosed RCE issues expanded the risk to virtualization, storage, update infrastructure, and server environments through `CVE-2026-21244` and `CVE-2026-21248` in **Windows Hyper-V**, `CVE-2025-62456` in **Windows Resilient File System (ReFS)**, `CVE-2025-59287` in **Windows Server Update Service (WSUS)**, `CVE-2025-49666` in **Windows Server Setup and Boot Event Collection**, `CVE-2024-49012` in **SQL Server Native Client**, `CVE-2025-21291` in **Windows Direct Show**, and `CVE-2026-24288` in the **Windows Mobile Broadband Driver**. One referenced case, `CVE-2021-34458`, showed the potential severity of Microsoft RCE flaws in virtualized environments, with Microsoft describing a **Critical** Windows Kernel issue that could enable cross-guest interference on systems using **SR-IOV-capable hardware**.
Jun 29, 2026