Loading story…
Microsoft released security bulletin MS13-002 to fix two privately reported remote code execution vulnerabilities in Microsoft XML Core Services (MSXML), tracked as CVE-2013-0006 and CVE-2013-0007. The flaws could be triggered if a user visited a specially crafted webpage in Internet Explorer, allowing an attacker to run arbitrary code with the privileges of the logged-on user. Microsoft rated the issue Critical for affected client platforms and for MSXML 5.0 components shipped with several Microsoft Office and server products, while most affected Windows Server systems were rated Moderate because of lower exposure.
The update changes how MSXML parses XML content and Microsoft urged organizations to deploy it promptly through automatic updating or Microsoft Update. The company also said update KB2687497 for SharePoint Server 2007 and Groove Server 2007 was rereleased as a new package and must be installed again even if the earlier MS12-043 version was already present. Microsoft said the vulnerabilities had not been publicly disclosed and there was no evidence of active exploitation when the bulletin was originally issued.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On December 16, 2013, Microsoft updated MS13-002 and stated that KB2687497 for SharePoint Server 2007 and Groove Server 2007 had been rereleased as a new package. Microsoft instructed customers to install the new package even if the original MS12-043 version was already installed.
On January 8, 2013, Microsoft published Security Bulletin MS13-002 to address the privately reported vulnerabilities CVE-2013-0006 and CVE-2013-0007 in Microsoft XML Core Services. Microsoft said the flaws could allow remote code execution if a user visited a specially crafted webpage in Internet Explorer and noted there was no public disclosure or active exploitation at the time of release.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 150 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
support.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcesupport.microsoft.com
Open sourcetechnet.microsoft.com
Open sourcetechnet.microsoft.com
Open sourcego.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released **MS14-080**, a cumulative security update for **Internet Explorer** that addressed 14 privately reported vulnerabilities across **IE 6 through IE 11**. The most severe flaws could allow **remote code execution** if a user visited a specially crafted webpage, with client systems generally rated **Critical** and affected Windows Server configurations rated **Moderate**. The bulletin said the update corrected multiple memory corruption issues, two **XSS filter bypass** flaws, an **ASLR bypass**, and the **VBScript** memory corruption bug tracked as `CVE-2014-6363`. Microsoft also published **MS14-084**, another **Critical** security bulletin, alongside later revisions to the Internet Explorer advisory that required additional updates in some environments, including **3029449** for **IE10** on Windows 8, Windows Server 2012, and Windows RT, and **3038314** for **IE11** on Windows 7 and Windows Server 2008 R2. The combined advisories highlighted urgent patching needs for Microsoft platforms because successful exploitation could let attackers run arbitrary code through user interaction with malicious content.
Aug 15, 2026
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting **Exchange Server** and **SharePoint Server**, including Exchange flaws tracked as `CVE-2023-21706`, `CVE-2023-28310`, and `CVE-2023-36439`, alongside SharePoint issues `CVE-2026-33110`, `CVE-2026-33112`, and `CVE-2026-40368`. The SharePoint vulnerabilities were tied to **deserialization of untrusted data** and were rated **Important**, with CVSS scores of **8.8** for `CVE-2026-33110` and `CVE-2026-33112`, and **8.0** for `CVE-2026-40368`. Microsoft said `CVE-2026-33110` could let an authenticated attacker with at least **Site Member** permissions execute code remotely on a vulnerable SharePoint Server, while `CVE-2026-33112` required at least **Site Owner** privileges to inject and run arbitrary code. For `CVE-2026-40368`, exploitation involved a client connecting to a malicious server, potentially leading to code execution on the client. Microsoft reported that the SharePoint flaws were **not publicly disclosed** and **not exploited in the wild** at publication, assessed exploitation as less likely, and released fixes, including a shared KB update for **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**.
Jun 29, 2026Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jul 23, 2026