Loading story…
Microsoft released security updates for two Windows Point-to-Point Tunneling Protocol (PPTP) remote code execution vulnerabilities, tracked as CVE-2022-41039 and CVE-2022-41088. Both issues affect the Windows implementation of PPTP, a legacy VPN tunneling protocol, and were published through Microsoft's Security Update Guide as separate advisories.
The paired disclosures indicate that attackers could potentially exploit weaknesses in the PPTP component to execute code on affected Windows systems, making patching a priority for organizations that still expose or rely on PPTP services. Security teams should identify systems with PPTP enabled, apply Microsoft's fixes for both CVEs, and review whether continued use of PPTP is necessary given its age and security history.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft added Security Update Guide entries for CVE-2022-41039 and CVE-2022-41088, both described as Windows Point-to-Point Tunneling Protocol remote code execution vulnerabilities.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several remote code execution vulnerabilities affecting core Windows networking and productivity components, including **Layer 2 Tunneling Protocol (L2TP)** flaws tracked as `CVE-2023-41765`, `CVE-2023-41770`, and `CVE-2023-41773`, a **Windows Remote Desktop Services** issue tracked as `CVE-2025-21297`, and a **Microsoft Office** vulnerability tracked as `CVE-2026-40358`. The advisories indicate that the affected attack surfaces span remote access, tunneling, and document-handling functionality, increasing the importance of patching internet-exposed and user-facing systems.
Jul 12, 2026
Microsoft disclosed and patched two **remote code execution** vulnerabilities in the Windows **Pragmatic General Multicast (PGM)** component, tracked as `CVE-2023-28250` and `CVE-2023-36397`. Both issues were published through Microsoft's Security Update Guide and affect the Windows networking feature used for reliable multicast message delivery. The advisories indicate that successful exploitation could allow code execution through the vulnerable PGM service, making exposed Windows systems a priority for patching. Organizations using Windows hosts with the PGM feature enabled should verify that security updates covering both CVEs have been applied and review asset exposure tied to the affected multicast service.
Jul 12, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026