Loading story…
Microsoft disclosed multiple Windows vulnerabilities affecting core system services, including CVE-2025-49723, a file tampering flaw in the Windows StateRepository API Server, CVE-2025-59203, an information disclosure issue in the Windows State Repository API Server, and CVE-2025-21349, a tampering vulnerability in the Windows Remote Desktop Configuration Service. The advisories were published through Microsoft's Security Update Guide as part of separate security updates.
The issues indicate risk across both local system state management and remote desktop configuration components, with the State Repository service exposed to both unauthorized file modification and file information disclosure scenarios. Organizations running affected Windows systems should prioritize applying Microsoft's security updates and review exposure in environments where Remote Desktop Services and State Repository-dependent applications are enabled.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2025-59203, a Windows State Repository API Server file information disclosure vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-49723, a Windows StateRepository API Server file tampering vulnerability.
Microsoft released a Security Update Guide entry for CVE-2025-21349, a Windows Remote Desktop Configuration Service tampering vulnerability.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026
Microsoft published security advisories for multiple remote code execution vulnerabilities affecting **Remote Desktop Client**, **Remote Desktop Protocol**, and the **Remote Procedure Call (RPC) Runtime**. The referenced issues include `CVE-2025-58718` in the Remote Desktop Client, alongside earlier Microsoft advisories for `CVE-2022-21851` in the Remote Desktop Client, `CVE-2022-21893` in Remote Desktop Protocol, and `CVE-2022-21922` in the RPC Runtime. The advisories indicate continued security risk around core Windows remote access and interprocess communication components that are widely used in enterprise environments. For defenders, the common thread is exposure to **remote code execution** in services and clients tied to remote connectivity, making Microsoft’s security updates for these CVEs a priority for systems that rely on RDP and RPC functionality.
Jul 12, 2026
Microsoft published security advisories for multiple Windows elevation-of-privilege vulnerabilities, including **`CVE-2026-40398`** in **Windows Remote Desktop Services** and **`CVE-2026-35420`** and **`CVE-2026-26180`** in the **Windows Kernel**. The flaws were listed in the Microsoft Security Update Guide as privilege escalation issues affecting core Windows components, expanding the set of local escalation risks defenders need to track across both kernel-level and remote desktop-related attack surfaces. The advisories provide official Microsoft tracking for the vulnerabilities but do not include public synopsis details in the referenced entries. For security teams, the immediate takeaway is to review Microsoft updates covering **Remote Desktop Services** and **Windows Kernel** components, prioritize patch deployment for systems where local access could be leveraged into higher privileges, and validate exposure across managed Windows endpoints and servers.
Jul 12, 2026