Loading story…
Microsoft resolved a Windows Update caching failure that caused some Intune- and enterprise-managed Windows devices to lose enrollment context temporarily and be treated as unmanaged, bypassing policies that block automatic driver deployment. The incident, tracked as MO1332784, led to unauthorized but Microsoft-signed driver and BIOS updates being installed across affected organizations, with some administrators reporting large-scale operational disruption including audio and video failures. Microsoft said the issue was mitigated, normal policy enforcement has resumed, and administrators should review systems for unexpected driver or BIOS changes and roll back affected updates where necessary.
Separately, Microsoft released Edge security updates for three vulnerabilities, including critical remote code execution flaw CVE-2026-45495, which could let an attacker execute code if a user visits a malicious webpage or opens a crafted file. The company also patched CVE-2026-45494, a universal cross-site scripting issue in navigation handling, and CVE-2026-45492, an origin validation error affecting Edge’s managed sign-in flow; both were publicly disclosed through ZDI advisories and credited to Orange Tsai of DEVCORE. Microsoft urged rapid browser updates and warned that the lower-severity Edge flaws could be chained with other bugs to increase impact.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a security update for Edge to fix CVE-2026-45495, a remote code execution flaw in feedback log processing, along with related vulnerabilities CVE-2026-45494 and CVE-2026-45492.
Microsoft updated admin center incident report MO1332784 to state that the caching misconfiguration had been fixed and advised administrators to review unexpected BIOS or driver changes installed between June 1 and June 4.
Microsoft resolved the service degradation that had bypassed Windows driver auto-update controls on managed devices, restoring normal policy enforcement and mitigating the caching-service misclassification issue.
ZDI publicly released advisories for CVE-2026-45492 and CVE-2026-45494, two Microsoft Edge flaws affecting origin validation and navigation handling. Both advisories said Microsoft had issued updates to address the issues.
The Microsoft 365 service degradation affecting Windows driver auto-update controls on managed devices was first reported and tracked as Microsoft reference MO1332784 and NHSmail reference INC46841357.
Microsoft acknowledged an incident in which a Windows Update caching service issue caused some enterprise-managed devices to be treated as unmanaged, bypassing driver approval restrictions and allowing unintended driver installations.
Orange Tsai of the DEVCORE Research Team reported the Microsoft Edge universal cross-site scripting vulnerability CVE-2026-45494 to ZDI under coordinated disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceghacks.net
Open sourcezerodayinitiative.com
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s latest security updates include a broad set of fixes across Windows, Office, Azure, Exchange, SharePoint, Remote Desktop, and other enterprise products, with several critical issues rated as highly likely to be exploited. Among the most serious is **`CVE-2026-47291`**, a critical **HTTP.sys** flaw with a **CVSS 9.8** score that can reportedly allow **unauthenticated remote code execution** in the Windows kernel-mode HTTP protocol stack, potentially giving attackers **SYSTEM-level** access. Microsoft also flagged multiple other high-risk issues in core Windows components and network-facing services, including vulnerabilities in **DHCP**, the **NT OS Kernel**, **NTLM**, **Remote Desktop Client**, and **SharePoint**. Separate Microsoft disclosures also detail new **Microsoft Edge (Chromium-based)** flaws affecting versions earlier than **`150.0.4078.48`**. These include **`CVE-2026-58281`**, a **deserialization of untrusted data** bug that can lead to remote code execution, and **`CVE-2026-58596`**, an **untrusted pointer dereference** issue that can enable elevation of privilege. Both vulnerabilities require user interaction but carry high impact if exploited, reinforcing concerns that browser and internet-exposed Windows components remain priority targets as vendors accelerate patch releases in response to faster vulnerability discovery and exploitation timelines.
Jul 14, 2026
Microsoft Edge (Chromium-based) has received fixes for multiple high-severity vulnerabilities, including remote code execution flaws `CVE-2026-58289`, `CVE-2026-58293`, `CVE-2026-58285`, `CVE-2026-58288`, `CVE-2026-57974`, `CVE-2026-58284`, `CVE-2026-58287`, `CVE-2026-57981`, and `CVE-2026-56645`, as well as the security feature bypass issue `CVE-2026-57983`. Public records attribute the issues to Microsoft and rate them from high to critical severity, with CVSS scores reaching **9.0** for `CVE-2026-58289` and several others scoring in the **8.1-8.8** range. Advisories from Microsoft and HKCERT indicate the flaws affect Microsoft Edge and require prompt patching through the browser's latest security updates. While some metadata inconsistently marks the bugs as not remotely exploitable, the listed attack characteristics for several entries include low attack complexity, no privileges required, and in many cases user interaction, making browser update compliance and rapid deployment a priority for enterprise defenders.
Jul 7, 2026
Microsoft released a security update for **Microsoft Edge (Chromium-based)** to remediate a high-severity remote code execution vulnerability tracked as **`CVE-2026-50521`**. According to the advisory, the flaw carries a **CVSS score of 8.3** and could allow a remote attacker to execute arbitrary code over a network. The vulnerability was described as having **low attack complexity**, requiring **low privileges** and **no user interaction**, increasing the urgency for enterprise remediation. Microsoft documented the fix in its Edge security release notes, and external defenders including **EG-FinCIRT** urged organizations to deploy the update promptly after standard testing to reduce exposure.
Jul 14, 2026