Loading story…
Microsoft disclosed two Elevation of Privilege vulnerabilities in the Microsoft Brokering File System, tracked as CVE-2025-49693 and CVE-2026-32219, through its Security Update Guide. Both advisories identify the same Windows component as affected, indicating a recurring privilege-escalation risk in the brokering layer that manages file system operations.
The vulnerabilities could allow an attacker with local access to gain higher privileges on a targeted Windows system if successfully exploited. Microsoft published security updates for both issues and organizations using affected Windows platforms should prioritize patching, validate update deployment across endpoints and servers, and monitor for signs of post-compromise privilege escalation involving the Brokering File System component.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-32219, another Microsoft Brokering File System Elevation of Privilege vulnerability, to its Security Update Guide.
Microsoft added CVE-2025-49693, a Microsoft Brokering File System Elevation of Privilege vulnerability, to its Security Update Guide.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for two Windows **elevation of privilege** vulnerabilities affecting core operating system components: **Windows File Explorer** (`CVE-2025-62565`) and **Windows NTFS** (`CVE-2025-55335`). The flaws were listed in the Microsoft Security Update Guide as separate issues impacting widely deployed Windows functionality tied to file browsing and the NTFS file system. The advisories provide limited public technical detail, but both issues could allow an attacker with existing access to a vulnerable system to gain higher privileges. Because the affected components are integral to Windows operations, organizations should review Microsoft’s update guidance for the relevant CVEs, prioritize patch deployment across supported Windows assets, and monitor for follow-on research or exploit activity that could increase operational risk.
Jul 12, 2026
Microsoft released fixes for several **Windows elevation-of-privilege vulnerabilities** affecting **Win32k**, **Windows Telephony Service**, **Desktop Window Manager**, and the **Windows Cloud Files Mini Filter Driver**. The disclosed flaws include `CVE-2026-34347`, `CVE-2026-42825`, `CVE-2026-27923`, and `CVE-2026-35418`, and are all tied to **use-after-free** conditions, with some cases also involving race conditions such as time-of-check time-of-use behavior. Microsoft said successful exploitation could let a locally authenticated attacker with low privileges gain **SYSTEM** access without user interaction. The vulnerabilities were rated **Important** with **CVSS 3.1 scores ranging from 7.0 to 7.8**, and Microsoft assessed exploitation as **less likely or unlikely** because several attacks require winning a race condition. At the time of disclosure, Microsoft reported **no public disclosure and no evidence of active exploitation** for the documented 2026 flaws, and stated that official security updates were available. Additional Microsoft advisories also reference related Windows and Microsoft Brokering File System elevation-of-privilege issues, including `CVE-2026-24285`, `CVE-2025-32712`, `CVE-2025-21372`, `CVE-2025-21315`, and `CVE-2025-59189`, though public technical details for those entries were limited.
Jun 29, 2026
Microsoft published security advisories for a series of **Windows elevation-of-privilege** vulnerabilities affecting the **Windows Kernel**, **File Explorer**, **Windows Management Service**, **Windows UI XAML Phone DatePickerFlyout**, **Windows Graphics Component**, **Windows Storage**, and the **DirectX Graphics Kernel**. The referenced flaws include `CVE-2026-26132`, `CVE-2025-62565`, `CVE-2025-54103`, `CVE-2025-54111`, `CVE-2025-55693`, `CVE-2024-38249`, `CVE-2025-62573`, `CVE-2024-38248`, and `CVE-2025-55678`. The disclosures indicate a broad patching effort spanning core operating system subsystems and user-facing Windows components, with repeated exposure in privileged areas such as the kernel and graphics stack. For defenders, the concentration of elevation-of-privilege issues across these components raises the risk that attackers could chain local access or code execution with privilege escalation to gain **SYSTEM-level** or otherwise expanded rights on affected Windows systems, making prompt validation and deployment of Microsoft updates a priority.
Jun 29, 2026