Loading story…
A public proof-of-concept exploit has been released for CVE-2026-42980, a high-severity Windows NT OS Kernel elevation-of-privilege flaw that allows a locally authenticated low-privileged user to gain NT AUTHORITY\SYSTEM access. The vulnerability stems from an integer underflow in the kernel's WMI serialization code that can trigger a heap-based buffer overflow and kernel memory corruption on supported Windows client and server releases, including Windows 10 Version 1607 and later builds.
Microsoft patched the issue in its June 2026 Patch Tuesday updates, assigned it a CVSS 3.1 score of 7.8, and assessed exploitation as "more likely." While there is no confirmed in-the-wild exploitation reported so far, the availability of exploit code raises the risk that attackers could use the bug after initial compromise to obtain full machine control, particularly on shared systems and servers. Microsoft has not provided a configuration workaround, making prompt deployment and validation of the June 2026 cumulative updates the primary mitigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A public proof-of-concept exploit for CVE-2026-42980 became available, increasing the risk that local authenticated attackers could escalate privileges to SYSTEM on affected Windows systems. The references note that no vendor had confirmed in-the-wild exploitation at the time of reporting.
Microsoft fixed CVE-2026-42980, a Windows NT OS Kernel elevation-of-privilege flaw caused by an integer underflow in WMI serialization code, in its June 9, 2026 Patch Tuesday updates. The company rated exploitation as "more likely" and provided no configuration workaround beyond applying the cumulative updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
Jul 12, 2026
Microsoft published details for **CVE-2026-26132**, an **Important** severity **Windows Kernel** *elevation of privilege* vulnerability caused by **CWE-416 (use-after-free)**. The issue is scored **CVSS 3.1: 7.8** with vector `AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating exploitation requires **local access** and **low complexity**, with **low privileges required** and **no user interaction**, and could result in high impact to confidentiality, integrity, and availability. Microsoft’s Security Update Guide entry provides standard machine-consumable references (e.g., *PowerShell*, *API*, and *CSAF* links) for tracking and patch management. No additional exploitation details, in-the-wild exploitation confirmation, or public proof-of-concept information is included in the provided material beyond the vulnerability classification and scoring.
Jul 12, 2026
Microsoft disclosed and patched multiple **elevation-of-privilege vulnerabilities** in the **Windows Common Log File System (CLFS) Driver**, including `CVE-2026-40407`, `CVE-2025-62470`, and `CVE-2025-32713`. The most detailed advisory, for `CVE-2026-40407`, describes a **heap-based buffer overflow** (`CWE-122`) that allows a locally authenticated low-privilege attacker to escalate to **SYSTEM** without user interaction. Microsoft rated `CVE-2026-40407` as **Important** with a **CVSS 3.1 score of 7.8**, citing **high** impact to confidentiality, integrity, and availability. The company said the flaw had **not** been publicly disclosed and was **not** being exploited in the wild at the time of publication, assessed exploitation as unlikely, and released an official security update to remediate the issue; the related CLFS advisories indicate a continuing pattern of privilege-escalation risk in this Windows component.
Jul 12, 2026