Loading story…
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing 206 to 208 CVEs addressed across Windows, Office, Azure, SQL Server, and other products, including 32 critical issues. Among the most urgent were multiple Remote Desktop Client remote code execution flaws—CVE-2026-42985, CVE-2026-47289, CVE-2026-44801, CVE-2026-44799, and CVE-2026-48563—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated CVE-2026-42985 as more likely to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab.
Microsoft also disclosed CVE-2026-47291, a critical HTTP.sys remote code execution vulnerability with a CVSS 9.8 score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default MaxRequestBytes setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Microsoft's Security Response Center published an advisory page for CVE-2026-3195 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Microsoft's Security Response Center published an advisory page for CVE-2026-49760 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Microsoft's Security Response Center published an advisory page for CVE-2026-11824 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Microsoft's Security Response Center published an advisory page for CVE-2025-49697 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Microsoft's Security Response Center published an advisory page for CVE-2025-49673 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Microsoft's Security Response Center published an advisory page for CVE-2025-48824 in its Update Guide. The existing timeline does not already include this specific vulnerability disclosure.
Following Microsoft's June 2026 Patch Tuesday disclosures, Cisco Talos published Snort coverage for many of the newly disclosed vulnerabilities. Talos specifically highlighted CVE-2026-42985, CVE-2026-47291, CVE-2026-44803, and CVE-2026-44812 as prominent issues and advised users to update to the latest rulesets.
On 2026-06-09, Microsoft received and published CVE-2026-45607, an out-of-bounds read vulnerability in Windows Hyper-V that could allow local code execution. The entry referenced Microsoft's Security Response Center update guide and classified the issue as high severity.
On 2026-06-09, Microsoft disclosed CVE-2026-47291, a critical Windows HTTP.sys remote code execution vulnerability that is network-exploitable without authentication or user interaction. Microsoft said exploitation was more likely, released a fix, and advised administrators to set MaxRequestBytes to a safe value and restart the HTTP service or system as a mitigation before patching.
On 2026-06-09, Microsoft disclosed several critical Remote Desktop Client remote code execution vulnerabilities, including CVE-2026-42985, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, and CVE-2026-48563. Microsoft said fixes were available for these issues and stated they were not publicly disclosed or exploited at publication, while rating CVE-2026-42985 as more likely to be exploited.
On 2026-06-09, Microsoft released its June 2026 Patch Tuesday updates, addressing a record-breaking set of vulnerabilities across its product portfolio. Sources describe the release as fixing 206 Microsoft vulnerabilities, while another report counts 208 Microsoft CVEs and 571 total when Chromium and bundled third-party components are included.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
22 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcemalware.news
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s latest security updates include a broad set of fixes across Windows, Office, Azure, Exchange, SharePoint, Remote Desktop, and other enterprise products, with several critical issues rated as highly likely to be exploited. Among the most serious is **`CVE-2026-47291`**, a critical **HTTP.sys** flaw with a **CVSS 9.8** score that can reportedly allow **unauthenticated remote code execution** in the Windows kernel-mode HTTP protocol stack, potentially giving attackers **SYSTEM-level** access. Microsoft also flagged multiple other high-risk issues in core Windows components and network-facing services, including vulnerabilities in **DHCP**, the **NT OS Kernel**, **NTLM**, **Remote Desktop Client**, and **SharePoint**. Separate Microsoft disclosures also detail new **Microsoft Edge (Chromium-based)** flaws affecting versions earlier than **`150.0.4078.48`**. These include **`CVE-2026-58281`**, a **deserialization of untrusted data** bug that can lead to remote code execution, and **`CVE-2026-58596`**, an **untrusted pointer dereference** issue that can enable elevation of privilege. Both vulnerabilities require user interaction but carry high impact if exploited, reinforcing concerns that browser and internet-exposed Windows components remain priority targets as vendors accelerate patch releases in response to faster vulnerability discovery and exploitation timelines.
Jul 14, 2026
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Aug 10, 2026
Microsoft released a broad security update covering roughly **398 to 421 vulnerabilities** across Windows, Office, Exchange, SharePoint, Azure, .NET, Teams, and other enterprise products, with **42 rated Critical**. The most urgent issue is **`CVE-2026-68820`**, an actively exploited elevation-of-privilege flaw in the Windows **`afd.sys`** Ancillary Function Driver for WinSock that can let an attacker with code execution gain **SYSTEM** privileges; reporting linked observed exploitation to **Lazarus** activity. Microsoft also addressed publicly disclosed flaws including **`CVE-2026-62832`**, and researchers warned it could be chained with the afd.sys bug for full system compromise. The release also fixes multiple high-impact server-side and enterprise-facing vulnerabilities, including critical or high-severity remote code execution bugs in **Windows iSCSI Target Service** (**`CVE-2026-65791`**, **`CVE-2026-65679`**), **Windows GDI+** (**`CVE-2026-62822`**), **Windows DHCP Server** (**`CVE-2026-62823`**), **Remote Desktop Client** (**`CVE-2026-62824`**), **Windows SMBv3 Server** (**`CVE-2026-62790`**, **`CVE-2026-62800`**), and **Microsoft Office** (**`CVE-2026-70130`**), alongside spoofing and privilege-escalation issues in **Azure Entra ID** (**`CVE-2026-62869`**), **Windows NAT** (**`CVE-2026-56179`**), **Exchange Server** (**`CVE-2026-62911`**), **.NET Framework** (**`CVE-2026-62872`**), and **Windows DNS** (**`CVE-2026-62778`**). Microsoft also completed remediation of an on-premises **SharePoint** exploit chain by patching **`CVE-2026-63520`** after July’s fix for **`CVE-2026-55040`**, prompting defenders to prioritize the exploited kernel flaw, exposed network services, and fully update SharePoint farms.
Aug 16, 2026