Loading story…
Microsoft disclosed and patched two vulnerabilities in Internet Connection Sharing (ICS) tracked as CVE-2025-21254 and CVE-2025-21216. Both issues are classified as denial-of-service flaws in the Windows ICS component, which is used to share a system’s network connection with other devices, and were published through the company’s Security Update Guide.
The advisories provide limited public technical detail, but the pairing of two ICS DoS entries indicates that unpatched Windows systems using the feature could face service disruption if the vulnerabilities are triggered. Organizations should review Microsoft’s guidance for both CVEs, identify Windows assets with ICS enabled, and prioritize deployment of the relevant security updates to reduce the risk of network-sharing outages.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft released Security Update Guide entries for CVE-2025-21216 and CVE-2025-21254, both affecting Internet Connection Sharing (ICS) and described as denial-of-service vulnerabilities.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft disclosed and patched three **Windows TCP/IP denial-of-service vulnerabilities** tracked as `CVE-2026-40405`, `CVE-2026-40413`, and `CVE-2026-40414`. The flaws stem from **NULL pointer dereference** conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues **Important**, assigned CVSS scores of **7.5** for `CVE-2026-40405` and **7.4** for `CVE-2026-40413` and `CVE-2026-40414`, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication. Microsoft said `CVE-2026-40413` and `CVE-2026-40414` are exploitable from an **adjacent network**, limiting attacks to the same network segment such as a shared switch or virtual network, while `CVE-2026-40405` is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a **scope change**, including scenarios in which a low-privilege **Hyper-V guest** could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Jun 29, 2026
Microsoft published security advisories for two **Important** remote **denial-of-service (DoS)** vulnerabilities affecting **.NET** and **ASP.NET Core**: **CVE-2026-26127** and **CVE-2026-26130**. Both issues are scored **CVSS 3.1 7.5** with `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating network-reachable exploitation with low complexity, no privileges, and no user interaction, resulting in high availability impact. CVE-2026-26127 is described as a **.NET DoS** condition associated with **CWE-125 (Out-of-bounds Read)**, while CVE-2026-26130 is an **ASP.NET Core DoS** issue associated with **CWE-770 (Allocation of Resources Without Limits or Throttling)**. Organizations running internet-exposed or high-availability services on these frameworks should prioritize applying Microsoft’s updates and review service-level protections (e.g., request throttling and resource limits) where applicable to reduce DoS risk.
Jun 29, 2026