Loading story…
Microsoft disclosed two elevation-of-privilege vulnerabilities affecting Windows Virtualization-Based Security (VBS), including CVE-2025-47159 and CVE-2025-21370. The issues impact VBS components designed to harden Windows by isolating sensitive processes and security functions from the rest of the operating system.
One of the flaws specifically affects VBS Enclaves, while the other targets VBS more broadly, indicating that protected execution environments within Windows can still present privilege-escalation risk if not patched. Microsoft published both entries through its Security Update Guide, signaling that organizations relying on VBS-backed protections should prioritize remediation and review exposure across systems using these security features.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2025-47159 to its Security Update Guide as a Windows Virtualization-Based Security (VBS) Elevation of Privilege vulnerability.
Microsoft added CVE-2025-21370 to its Security Update Guide as a Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcezeropath.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several vulnerabilities affecting **Windows Virtualization-Based Security (VBS)** and **VBS Enclave** components, including elevation-of-privilege issues tracked as `CVE-2025-48803`, `CVE-2025-48811`, and `CVE-2025-53717`. The advisories indicate that flaws in these protected execution and isolation features could allow an attacker to gain higher privileges on affected Windows systems. Microsoft also disclosed `CVE-2025-21340`, a **security feature bypass** in Windows VBS, expanding the scope beyond privilege escalation to weaknesses that could undermine VBS protections themselves. Together, the advisories highlight repeated security issues in Windows virtualization-based isolation mechanisms and reinforce the need for organizations using VBS-backed protections to review affected systems and apply Microsoft updates.
Jul 12, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026
Microsoft has published security advisories for **CVE-2026-40402**, a **Windows Hyper-V Elevation of Privilege** vulnerability listed in the Microsoft Security Update Guide. The flaw affects Hyper-V, Microsoft's virtualization platform, and could allow an attacker to gain elevated privileges on a vulnerable system. The advisory was released through Microsoft's public update channels, including the Security Update Guide and MSRC advisory pages, but no public synopsis or technical details were provided in the referenced notices. Organizations using **Windows Hyper-V** should review Microsoft's guidance for affected versions, patch availability, and any mitigation steps tied to `CVE-2026-40402`.
Jul 12, 2026