Loading story…
Microsoft released security updates for 203 vulnerabilities across its product portfolio, including 33 rated critical, and patched six zero-day flaws. One of the zero-days, CVE-2026-42897, was reported as actively exploited in the wild; it affects Microsoft Exchange Server and allows spoofing through an input-sanitization weakness that can trigger JavaScript execution in the Outlook on the web context when a crafted email is opened.
The update set also addressed multiple Windows zero-days, including the Windows BitLocker Security Feature Bypass Vulnerability tracked as CVE-2026-45585. According to public reporting, the Windows flaws span components such as CTFMON, HTTP.sys, BitLocker, and the Cloud Files Mini Filter Driver, with impacts including privilege escalation, denial of service, security feature bypass, and potential access to encrypted data. Microsoft urged organizations to deploy the patches promptly to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft released its June 2026 security updates addressing 203 vulnerabilities, including 33 critical flaws and six zero-days. CSIRT.SK highlighted that one of the zero-days, CVE-2026-42897 affecting Microsoft Exchange Server, was actively exploited in the wild.
Microsoft's Security Update Guide published an advisory for CVE-2026-45585, a Windows BitLocker Security Feature Bypass Vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its largest Patch Tuesday update to date, fixing **206 vulnerabilities** across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included **three publicly disclosed zero-days**, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw `CVE-2026-41091`. Publicly disclosed issues in the June bundle included `CVE-2026-50507`, a **BitLocker** security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and `CVE-2026-45586`, a **Windows CTFMON** elevation-of-privilege flaw that could let a low-privileged local attacker gain **SYSTEM** access. JPCERT/CC also warned that Microsoft disclosed active exploitation of `CVE-2026-42897`, a spoofing flaw in **Microsoft Exchange Server**.
Jul 3, 2026
Microsoft patched multiple actively exploited vulnerabilities across Windows, Outlook, Office, and Exchange Server, including the Outlook flaw **CVE-2024-21413** and the Exchange Server issue **CVE-2024-21410**. The February Patch Tuesday release addressed 73 vulnerabilities in total, with five rated critical, and included fixes for additional zero-days such as **CVE-2024-21412** involving Internet Shortcut/LNK files and **CVE-2024-21351**, a security feature bypass used in attacks. The Outlook vulnerability **CVE-2024-21413** stems from improper parsing of `file://` links, allowing attackers to bypass Protected View, leak NTLM credentials, and potentially achieve remote code execution. In Exchange Server, **CVE-2024-21410** allows an unauthenticated attacker to capture and relay Net-NTLMv2 authentication material; defenders were urged to apply Microsoft’s security updates immediately and enable **Extended Protection for Authentication** on Exchange systems.
Jul 24, 2026
Microsoft released its October 2024 security updates with fixes for **118 vulnerabilities** across Windows and other products, including **3 critical flaws**, **5 zero-days**, and **2 vulnerabilities reported as actively exploited in the wild**. The zero-days highlighted in public reporting include `CVE-2024-43573` in **MSHTML**, `CVE-2024-43572` in **Microsoft Management Console** handling of `.msc` files, `CVE-2024-6197` in **libcurl**, `CVE-2024-20659` in **Hyper-V**, and `CVE-2024-43583` in **Winlogon**. Microsoft documented the release in its Security Update Guide release notes. The two exploited issues were identified as an **MSHTML spoofing vulnerability** and a **Microsoft Management Console remote code execution flaw** tied to malicious `.msc` files. Guidance accompanying the release urged organizations to prioritize rapid deployment of the October patches, with additional mitigation advice for `CVE-2024-43583`: administrators were advised to enable the official Microsoft IME to reduce exposure from vulnerable third-party input method editors affecting Winlogon.
Jul 24, 2026