Loading story…
Microsoft published Security Update Guide entries for CVE-2024-49114 and CVE-2022-21899, identifying Windows security weaknesses that could allow a security feature bypass. One of the referenced advisories explicitly describes CVE-2022-21899 as a Windows Extensible Firmware Interface Security Feature Bypass Vulnerability, pointing to risk in the platform’s boot and firmware trust chain.
The available references provide limited technical detail, but both entries indicate Microsoft formally tracked and disclosed the issues through its Security Update Guide and advisory portal. For defenders, the disclosures highlight the need to review Microsoft guidance for affected Windows and firmware-related components, validate patch status, and prioritize systems where bypassing built-in protections could weaken secure boot or other platform security controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2024-49114. No additional incident or exploitation details are provided in the reference content.
Microsoft published a Security Update Guide advisory for CVE-2022-21899, a Windows Extensible Firmware Interface Security Feature Bypass Vulnerability.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **security feature bypass** vulnerabilities affecting **Windows BitLocker** and **Windows Boot Manager**, publishing advisories for `CVE-2025-48804`, `CVE-2025-48001`, `CVE-2025-55338`, and `CVE-2022-30203`. The BitLocker issues were identified as bypass flaws rather than remote code execution bugs, indicating a risk that attackers could undermine disk encryption protections or related trust controls under certain conditions. The advisories show a recurring focus on protections tied to the Windows boot chain and full-disk encryption, with three separate BitLocker bypass CVEs and one Boot Manager bypass CVE documented by Microsoft. While Microsoft did not provide public synopses in the referenced notices, the updates signal that organizations relying on **BitLocker** and secure startup protections should prioritize review and deployment of the relevant Windows security patches to reduce the chance of pre-boot or local protection mechanisms being circumvented.
Jul 12, 2026
Microsoft has issued security advisories for a series of **Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability** flaws affecting the browser across multiple release cycles. The referenced issues include `CVE-2021-31982`, `CVE-2021-34506`, `CVE-2023-21719`, `CVE-2023-29345`, `CVE-2023-29354`, `CVE-2023-36878`, `CVE-2024-26163`, `CVE-2024-26247`, `CVE-2024-29991`, and `CVE-2025-53791`, all published through Microsoft's Security Update Guide and MSRC portal. The advisories identify a recurring class of weakness in Edge in which built-in browser protections can be bypassed, potentially reducing the effectiveness of security boundaries and defensive controls. While the provided notices do not include technical synopses, the volume and continuity of CVEs show Microsoft repeatedly addressing security-feature-bypass conditions in Edge, underscoring the need for organizations to keep the Chromium-based browser fully updated and to track MSRC guidance for remediation.
Jul 12, 2026
Microsoft has disclosed a sustained series of **security feature bypass** vulnerabilities across Windows and related components, with multiple advisories tied to **Mark of the Web (MotW)**, **SmartScreen**, **MapUrlToZone**, Windows shortcut handling, and security zone mapping. The most detailed recent case, `CVE-2026-32225`, affects **Windows Shell** and allows attackers to bypass SmartScreen protections that rely on MotW by persuading a user to open a specially crafted `.lnk` file. Microsoft said successful exploitation could cause Windows to launch commands or Control Panel applets without proper MotW handling, potentially enabling arbitrary command execution or the loading of attacker-controlled DLLs; the flaw was rated **Important**, assigned a **CVSS 8.8**, marked as **more likely to be exploited**, and fixed at disclosure. The newer Windows Shell issue follows a broader pattern of Microsoft fixes for related bypasses, including `CVE-2022-44698` in **Windows SmartScreen**; `CVE-2023-36564` in **Windows Search**; `CVE-2023-36584`, `CVE-2024-38217`, and `CVE-2024-43487` in **Windows Mark of the Web**; `CVE-2024-30073` in **Windows Security Zone Mapping**; `CVE-2025-21328`, `CVE-2025-21329`, and `CVE-2025-21332` in **MapUrlToZone**; and `CVE-2025-47160` in **Windows Shortcut Files**. Additional bypass advisories affected Microsoft products including **Publisher**, **Office Developer Platform**, **PowerShell**, **Kerberos**, **Windows Hello**, **Surface**, and **PC Manager**, underscoring Microsoft's continued effort to close gaps in trust labeling and execution safeguards that attackers can abuse to reduce warnings and increase the success of social-engineering attacks.
Jun 29, 2026