Loading story…
Microsoft's February 2026 Patch Tuesday fixed 54 vulnerabilities across Windows, Windows Server, Office, Exchange, SharePoint, Visual Studio, .NET, Azure services, and Defender for Endpoint for Linux. Six of the patched flaws were reported as actively exploited in the wild, affecting Windows Shell, MSHTML Framework, Microsoft Word, Desktop Window Manager, Windows Remote Access Connection Manager, and Windows Remote Desktop, prompting calls for immediate deployment of security updates.
The release also addressed two critical vulnerabilities in Azure Compute Gallery: CVE-2026-21522 and CVE-2026-23655. According to the advisory, the bugs could enable privilege escalation and unauthorized access to sensitive data, including tokens and keys, expanding the risk beyond endpoint compromise to cloud-hosted assets and administrative credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft released its February 2026 Patch Tuesday security updates to fix 54 vulnerabilities across its product portfolio, including two critical flaws and six vulnerabilities reported as actively exploited in the wild. The updates affected products including Windows, Windows Server, Office, Exchange, SharePoint, Visual Studio, .NET, Azure services, and Defender for Endpoint for Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for 172 vulnerabilities across Windows, Office, Exchange, SharePoint, .NET, Visual Studio, PowerShell, and Windows Server, with **8 rated critical** and **162 rated important**. The company said **6 vulnerabilities were actively exploited in the wild**, including Windows privilege-escalation flaws affecting the **Agere Modem native driver** and **Windows Remote Access Connection Manager**, while critical issues in the release included remote code execution and privilege-escalation risks. The update set also referenced related security issues involving **IGEL OS Secure Boot**, **AMD EPYC SEV-SNP**, and the **TCG TPM 2.0** specification, with Microsoft still working on mitigations for Azure Confidential Computing exposure tied to the AMD issue. Microsoft’s Security Update Guide included advisory **`CVE-2025-24990`**, and defenders were urged to deploy patches through standard Microsoft update channels and review product-specific guidance immediately.
Jul 24, 2026
Microsoft released its May Patch Tuesday updates fixing 137 vulnerabilities across Windows, Office, Azure, Dynamics 365, SharePoint, Copilot, and other products, with no actively exploited zero-days or publicly disclosed flaws reported at release. The update included multiple high-severity remote code execution bugs, notably Microsoft Word flaws `CVE-2026-40361` and `CVE-2026-40364`, which can be triggered through the Preview Pane by sending a malicious document, as well as `CVE-2026-42898` in Microsoft Dynamics 365 On-Premises, `CVE-2026-42823` in Azure Logic Apps, and `CVE-2026-33109` in Azure Managed Instance for Apache Cassandra. Researchers also flagged `CVE-2026-41089` in Windows Netlogon and `CVE-2026-41096` in Windows DNS Client as especially urgent because they expose broadly deployed enterprise infrastructure to remote compromise. Microsoft’s Windows 11 cumulative updates, including `KB5089549` and `KB5087420`, delivered many of the security fixes alongside reliability and usability improvements, and Microsoft said it was not aware of new issues with the release. Coverage and advisories also showed the breadth of the month’s attack surface, with additional fixes for SharePoint Server remote code execution, Office Click-to-Run privilege escalation, Hyper-V guest-to-host escalation, Teams spoofing, Outlook for iOS tampering, and several Copilot and Visual Studio Code vulnerabilities. Security researchers said the growing volume of Microsoft disclosures may reflect increased AI-assisted vulnerability discovery, while defenders were urged to prioritize patching domain controllers, DNS-exposed Windows systems, Office deployments, and internet-facing enterprise applications.
Jul 20, 2026
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026