Loading story…
Microsoft published advisories for Windows Defender Credential Guard security feature bypass vulnerabilities tracked as CVE-2022-21921 and CVE-2024-43451. The notices indicate that protections designed to isolate and safeguard credentials in Windows can be circumvented under certain conditions, potentially weakening a key defense against credential theft and lateral movement on affected systems.
The disclosures add to Microsoft's ongoing stream of Security Update Guide entries covering Windows authentication and isolation protections. For defenders, the immediate concern is whether affected Windows endpoints and servers have received the relevant Microsoft security updates, because a successful bypass of Credential Guard can reduce the effectiveness of one of the platform's primary controls for protecting cached and derived credentials.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide advisory for CVE-2024-43451. No additional synopsis or technical details are provided in the reference content.
Microsoft published a Security Update Guide advisory for CVE-2022-21921, identified as a Windows Defender Credential Guard security feature bypass vulnerability.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published Security Update Guide entries for **`CVE-2024-49114`** and **`CVE-2022-21899`**, identifying Windows security weaknesses that could allow a **security feature bypass**. One of the referenced advisories explicitly describes **`CVE-2022-21899`** as a **Windows Extensible Firmware Interface Security Feature Bypass Vulnerability**, pointing to risk in the platform’s boot and firmware trust chain. The available references provide limited technical detail, but both entries indicate Microsoft formally tracked and disclosed the issues through its Security Update Guide and advisory portal. For defenders, the disclosures highlight the need to review Microsoft guidance for affected Windows and firmware-related components, validate patch status, and prioritize systems where bypassing built-in protections could weaken secure boot or other platform security controls.
Jul 12, 2026
Microsoft disclosed multiple **security feature bypass** vulnerabilities affecting **Windows BitLocker** and **Windows Boot Manager**, publishing advisories for `CVE-2025-48804`, `CVE-2025-48001`, `CVE-2025-55338`, and `CVE-2022-30203`. The BitLocker issues were identified as bypass flaws rather than remote code execution bugs, indicating a risk that attackers could undermine disk encryption protections or related trust controls under certain conditions. The advisories show a recurring focus on protections tied to the Windows boot chain and full-disk encryption, with three separate BitLocker bypass CVEs and one Boot Manager bypass CVE documented by Microsoft. While Microsoft did not provide public synopses in the referenced notices, the updates signal that organizations relying on **BitLocker** and secure startup protections should prioritize review and deployment of the relevant Windows security patches to reduce the chance of pre-boot or local protection mechanisms being circumvented.
Jul 12, 2026
Microsoft disclosed and patched three Windows spoofing vulnerabilities affecting the **Windows Security App**, **Windows Storage**, and **NTLM** authentication components. The issues were tracked as `CVE-2025-47956`, `CVE-2025-49760`, and `CVE-2025-24054`, with the last specifically described as an **NTLM Hash Disclosure Spoofing Vulnerability**, raising the risk of credential exposure through spoofing-related attack paths. The advisories were published through Microsoft's Security Update Guide and indicate that multiple core Windows components required security fixes for spoofing weaknesses. For defenders, the disclosures highlight the need to prioritize Microsoft security updates, review systems that rely on NTLM authentication, and assess whether exposed Windows endpoints or storage-related workflows could be abused for impersonation, misleading trust signals, or credential theft.
Jul 12, 2026