Loading story…
Microsoft has patched CVE-2026-50663, a remote code execution flaw in Age of Empires II: Definitive Edition caused by a relative path traversal issue (CWE-23). The vulnerability affects versions starting at 1.0.0 and earlier than 101.103.46651.0, and carries a high-severity CVSS 3.1 score with impact to confidentiality, integrity, and availability. According to Microsoft’s advisory, the bug could be exploited over a network by an unauthenticated attacker with user interaction.
Reporting on the patch said the flaw could be triggered by sending a specially crafted malicious game invite that places malicious files on a target system and ultimately executes code, potentially giving an attacker control of the victim’s machine. Microsoft included the fix in a broader Patch Tuesday release, and there is no evidence so far that the vulnerability has been exploited in the wild.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SecurityOnline reports that Microsoft patched CVE-2026-50663 in the April 2026 update for Age of Empires II: Definitive Edition, version 101.103.46651.0. The fix addressed a path traversal issue that could lead to remote code execution when joining a malicious game lobby.
Microsoft patched CVE-2026-50663 in Age of Empires II: Definitive Edition as part of its July 2026 Patch Tuesday release. The flaw could be triggered through a specially crafted malicious game invite, and reports said there was no evidence of in-the-wild exploitation.
The CVE entry for CVE-2026-50663 states it was received by secure@microsoft.com on 2026-07-14. The vulnerability affects Age of Empires II: Definitive Edition and can allow remote code execution via relative path traversal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityonline.info
Open sourcetechcrunch.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft has patched **CVE-2026-62832**, a high-severity Windows User Profile Service elevation-of-privilege flaw publicly known as **LegacyHive**. The vulnerability stems from improper link resolution before file access (`CWE-59`) and affects supported versions of **Windows 10**, **Windows 11**, **Windows Server 2022**, and **Windows Server 2025** prior to patched builds. Microsoft scored the bug **7.8 CVSS v3.1**, and the issue allows an authorized local attacker to escalate privileges on vulnerable systems. Public reporting said the flaw could let an authenticated attacker with credentials for another local account load that user's registry hive, alter data, and potentially obtain administrator privileges without user interaction. The zero-day was publicly disclosed by the researcher known as **Nightmare Eclipse**, who released a proof-of-concept exploit after the July Patch Tuesday updates; researchers including **Will Dormann** and **Kevin Beaumont** analyzed the exploit, while **ACROS Security** had already issued unofficial **0Patch** micropatches before Microsoft's official advisory and fix were released.
Aug 13, 2026