Loading story…
Microsoft published security advisories for two Windows denial-of-service vulnerabilities affecting core platform components: CVE-2025-21350 in Windows Kerberos and CVE-2025-59198 in the Windows Search Service. The flaws were listed in the Microsoft Security Response Center's Security Update Guide as separate issues impacting authentication and search functionality within Windows environments.
The advisories provide official tracking and patch guidance for organizations running affected Windows systems, highlighting the risk that attackers could disrupt service availability rather than execute code or elevate privileges. Security teams should review the relevant MSRC entries, determine exposure across domain-connected and endpoint systems, and prioritize remediation for assets that rely heavily on Kerberos authentication or Windows Search operations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2025-59198, a Windows Search Service Denial of Service vulnerability, to its Security Update Guide. The reference indicates public disclosure through Microsoft's advisory on this date.
Microsoft added CVE-2025-21350, a Windows Kerberos Denial of Service vulnerability, to its Security Update Guide. The reference indicates public disclosure through Microsoft's advisory on this date.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several Windows vulnerabilities spanning core components including the DirectX Graphics Kernel, Windows Themes, Windows Desired State Configuration (DSC), and the Windows Search Service. The issues include denial-of-service flaws tracked as `CVE-2022-21918`, `CVE-2024-30065`, and `CVE-2025-59190`, as well as an information disclosure vulnerability, `CVE-2022-30148`, affecting DSC. The disclosures indicate that widely used Windows subsystems remained exposed to different classes of security risk across multiple product areas, from graphics and theming to configuration management and search. Organizations relying on Windows endpoints and servers would need to review Microsoft’s Security Update Guide entries for the affected components and apply the relevant patches or mitigations to reduce the risk of service disruption or unintended data exposure.
Jul 12, 2026
Microsoft published security advisories for a broad set of **denial-of-service** vulnerabilities affecting Windows components and related software, including **IP Helper** (`CVE-2025-21231`), **Windows Virtual Trusted Platform Module** (`CVE-2025-21280`), **Windows Remote Desktop Services** (`CVE-2025-21330`), **DHCP Client Service** (`CVE-2025-21179`), **Windows Active Directory Domain Services API** (`CVE-2025-21351`), **Windows Hyper-V** (`CVE-2025-62567`), **Windows Kerberos** (`CVE-2022-41053`), and **Microsoft Defender** (`CVE-2023-36010`). The disclosures indicate continued exposure of core enterprise infrastructure services to attacks that can disrupt availability without necessarily compromising data or system integrity. Microsoft also issued an advisory for **Prometheus** remote read endpoint vulnerability `CVE-2026-42154`, describing a remotely exploitable flaw caused by a crafted **snappy** payload that can trigger uncontrolled resource consumption. Microsoft rated the issue **CVSS 7.5** and said it requires **no privileges** and **no user interaction**, with impact focused on sustained or persistent service outages. Together, the advisories highlight availability risks spanning identity, networking, virtualization, endpoint protection, remote access, and monitoring systems commonly deployed in enterprise environments.
Jun 29, 2026
Microsoft published security advisories for several Windows **information disclosure** flaws affecting core services and components, including the **Windows CSC Service** (`CVE-2025-21374`), **WLAN AutoConfig Service** (`CVE-2025-21257`), **Storage Management Provider** (`CVE-2025-33055`, `CVE-2025-33062`, `CVE-2025-55325`), and **Cryptographic Services** (`CVE-2025-58720`). The advisories indicate that sensitive information could be exposed through weaknesses in widely deployed Windows functionality spanning storage, networking, and cryptographic operations. The disclosures also align with Microsoft's earlier reporting on a similar **Windows iSCSI Target Service Information Disclosure Vulnerability** tracked as `CVE-2023-24945`, underscoring a recurring class of exposure issues across Windows services. While the referenced entries provide limited public technical detail, the breadth of affected components suggests defenders should prioritize Microsoft security updates and review systems that rely on these services for potential exposure to unintended data leakage.
Jul 12, 2026