Loading story…
Microsoft’s latest security updates include a broad set of fixes across Windows, Office, Azure, Exchange, SharePoint, Remote Desktop, and other enterprise products, with several critical issues rated as highly likely to be exploited. Among the most serious is CVE-2026-47291, a critical HTTP.sys flaw with a CVSS 9.8 score that can reportedly allow unauthenticated remote code execution in the Windows kernel-mode HTTP protocol stack, potentially giving attackers SYSTEM-level access. Microsoft also flagged multiple other high-risk issues in core Windows components and network-facing services, including vulnerabilities in DHCP, the NT OS Kernel, NTLM, Remote Desktop Client, and SharePoint.
Separate Microsoft disclosures also detail new Microsoft Edge (Chromium-based) flaws affecting versions earlier than 150.0.4078.48. These include CVE-2026-58281, a deserialization of untrusted data bug that can lead to remote code execution, and CVE-2026-58596, an untrusted pointer dereference issue that can enable elevation of privilege. Both vulnerabilities require user interaction but carry high impact if exploited, reinforcing concerns that browser and internet-exposed Windows components remain priority targets as vendors accelerate patch releases in response to faster vulnerability discovery and exploitation timelines.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2026-55005 in the MSRC Update Guide on July 14, 2026, describing a heap-based buffer overflow in Microsoft Exchange Server that could allow authorized remote code execution. The entry lists affected versions including Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM on x64 systems.
A Reddit post highlighted external technical analysis of CVE-2026-47291, describing the Windows HTTP.sys flaw as an integer overflow enabling unauthenticated remote code execution with SYSTEM-level privileges. The discussion referenced reverse engineering details, affected functions, and reproduction information.
The CVE record for CVE-2026-58596 states Microsoft received the report on July 12, 2026. The flaw is an untrusted pointer dereference in Microsoft Edge that could allow elevation of privilege over a network.
A vulnerability entry for CVE-2026-58281 described a deserialization of untrusted data flaw in Microsoft Edge that could allow remote code execution. The entry states affected versions are earlier than 150.0.4078.48 and cites Microsoft as the reference.
A Microsoft Edge security update was published on June 28, 2026, indicating a browser patch release tied to security fixes. The reference provides the publication date but no additional technical details in the supplied content.
Microsoft published its June 2026 security updates covering numerous products and services, including critical flaws such as CVE-2026-47291 in Windows HTTP.sys and several other high-severity vulnerabilities marked as more likely to be exploited.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcecvefeed.io
Open sourcereddit.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft released fixes for **117 vulnerabilities** across 15 product families, including **3 Critical**, **110 Important**, **3 Moderate**, and **1 Low** severity issues. Two flaws were already being exploited in the wild: `CVE-2024-43572` in **Microsoft Management Console** and `CVE-2024-43573` in the **Windows MSHTML Platform**. Microsoft also flagged eight additional vulnerabilities as more likely to be exploited within 30 days, while Windows accounted for the vast majority of the exposure with **93 CVEs** spanning remote code execution, elevation of privilege, and denial-of-service bugs. The most severe issues included `CVE-2024-43468`, a **Critical Microsoft Configuration Manager remote code execution** flaw with a **CVSS 9.8** score that requires an in-console update and additional hardening, and `CVE-2024-38124`, a **Windows Netlogon elevation of privilege** vulnerability with mitigation guidance. The release also addressed 15 Windows Mobile Broadband Driver flaws that generally require physical access or proximity, Windows 11 24H2-specific bugs such as `CVE-2024-43527` and `CVE-2024-43571`, and advisory items affecting Edge and curl-related components; Sophos said protections were available for `CVE-2024-43502`, `CVE-2024-43572`, and `CVE-2024-43573`.
Jun 29, 2026
Microsoft released fixes for **163 CVEs** across 17 product families, including **8 Critical** vulnerabilities, **1 publicly disclosed** flaw, and **1 vulnerability under active exploitation**. The exploited issue, `CVE-2026-32201`, is a **Microsoft SharePoint Server spoofing vulnerability** that can let an unauthenticated attacker impersonate a user and read or modify certain data. Microsoft also patched `CVE-2026-33825`, a **publicly disclosed Microsoft Defender elevation-of-privilege flaw** that affects systems only when Defender is enabled; the company said customers using Defender automatic updates are remediated automatically. Among the most severe issues, Microsoft highlighted `CVE-2026-33824`, a **Critical Windows Internet Key Exchange (IKE) Service Extensions remote code execution vulnerability** with a **CVSS 9.8**, and advised defenders to restrict **UDP ports 500 and 4500** until patching is complete. Elevation-of-privilege bugs made up the largest share of the release with **94 CVEs**, while **Windows** accounted for **131** of the patched vulnerabilities. Microsoft said **24 flaws** were more likely to be exploited within 30 days, **18** carried CVSS scores of **8.0 or higher**, and the release also included **80 Edge-related advisories**, most inherited from Chrome.
Jun 29, 2026