Loading story…
Microsoft released fixes for multiple Windows elevation-of-privilege vulnerabilities, including CVE-2024-30093 in Windows Storage and CVE-2024-30076 in the Windows Container Manager Service. Both issues were published through the Microsoft Security Response Center update guide as local privilege escalation flaws that could allow an attacker with existing access to gain higher privileges on affected Windows systems.
The Container Manager Service issue continues a pattern of privilege escalation bugs in the same component, following earlier Microsoft advisories for CVE-2023-36723 and CVE-2022-30132. The repeated appearance of elevation-of-privilege vulnerabilities in this service highlights the need for defenders to prioritize Windows security updates, especially on systems using containers or other workloads that rely on the affected components.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2024-30093, an elevation of privilege vulnerability affecting Windows Storage.
Microsoft published a Security Update Guide entry for CVE-2024-30076, describing an elevation of privilege vulnerability in the Windows Container Manager Service.
Microsoft published a Security Update Guide entry for CVE-2023-36723, another elevation of privilege vulnerability in the Windows Container Manager Service.
Microsoft published a Security Update Guide entry for CVE-2022-30132, an elevation of privilege vulnerability affecting the Windows Container Manager Service.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026
Microsoft disclosed and patched several Windows elevation of privilege vulnerabilities affecting core platform components, including **Windows App Package Installer**, **Windows Installer**, and **Windows Authentication**. The referenced issues are tracked as `CVE-2025-21275`, `CVE-2025-33075`, `CVE-2025-32714`, and `CVE-2025-55701`, indicating that attackers who already have some level of access could potentially exploit weaknesses in trusted Windows services to gain higher privileges on affected systems. The vulnerabilities span software installation and authentication mechanisms that are widely present in enterprise environments, increasing their relevance for defenders managing Windows fleets. Organizations should prioritize applying Microsoft security updates for affected systems and review exposure across endpoints and servers where installer workflows or Windows authentication components are in use, as elevation of privilege flaws can be chained with other compromises to expand attacker control.
Jul 12, 2026
Microsoft published security updates for several **Windows elevation of privilege** vulnerabilities affecting core components including **Win32k** (`CVE-2024-30082`, `CVE-2023-36743`), **Microsoft COM for Windows** (`CVE-2025-21281`), the **Microsoft Graphics Component** (`CVE-2025-49708`), and the **Windows Search Service** (`CVE-2026-27909`). The advisories indicate that successful exploitation could allow an attacker to gain higher privileges on a targeted Windows system, increasing the risk of broader compromise after initial access. The affected components span user interface, inter-process communication, graphics, and search functionality, showing continued exposure in widely deployed parts of the Windows platform. Microsoft issued entries for each CVE through its Security Update Guide, including both vulnerability and advisory records for `CVE-2025-21281`, and organizations should prioritize patching these flaws as part of routine Windows security maintenance because privilege escalation bugs are commonly chained with other exploits to obtain **SYSTEM**-level or administrative control.
Jul 12, 2026