Loading story…
Microsoft released fixes for 63 vulnerabilities across its product portfolio, including five rated critical and one actively exploited zero-day. The exploited flaw, tracked as CVE-2025-62215, is a Windows kernel double-free race condition that enables local privilege escalation to SYSTEM without user interaction, according to Microsoft’s Security Update Guide and CSIRT.SK reporting.
The November 2025 updates also addressed additional high-severity issues spanning Windows, Microsoft Office, Visual Studio, Microsoft Graphics Component (GDI+), and Nuance PowerScribe 360, with impacts including remote code execution, information disclosure, and privilege escalation. Security advisories for vulnerabilities including CVE-2025-60716 and CVE-2025-62215 were published through Microsoft’s update channels, and defenders were urged to deploy the patches promptly because one flaw was already being exploited in the wild.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft's November 2025 Patch Tuesday fixed CVE-2025-62215, a Windows kernel double-free race condition vulnerability that allows local privilege escalation to SYSTEM without user interaction. CSIRT.SK reported the flaw was being actively exploited as a zero-day at the time of the update release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for 172 vulnerabilities across Windows, Office, Exchange, SharePoint, .NET, Visual Studio, PowerShell, and Windows Server, with **8 rated critical** and **162 rated important**. The company said **6 vulnerabilities were actively exploited in the wild**, including Windows privilege-escalation flaws affecting the **Agere Modem native driver** and **Windows Remote Access Connection Manager**, while critical issues in the release included remote code execution and privilege-escalation risks. The update set also referenced related security issues involving **IGEL OS Secure Boot**, **AMD EPYC SEV-SNP**, and the **TCG TPM 2.0** specification, with Microsoft still working on mitigations for Azure Confidential Computing exposure tied to the AMD issue. Microsoft’s Security Update Guide included advisory **`CVE-2025-24990`**, and defenders were urged to deploy patches through standard Microsoft update channels and review product-specific guidance immediately.
Jul 24, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft released security updates for **139 vulnerabilities** across Windows, Windows Server, SharePoint, SQL Server, Office, .NET, Azure CycleCloud, and Visual Studio, including **54 remote code execution flaws**, **5 critical issues**, and **4 zero-days**. The most severe vulnerabilities affected **Microsoft SharePoint Server**, the **Windows Imaging Component**, and the **Windows Remote Desktop Licensing Service**, expanding the risk of remote compromise, privilege escalation, spoofing, security feature bypass, unauthorized data access, and denial-of-service attacks. Two of the zero-days, **`CVE-2024-38080`** and **`CVE-2024-38112`**, were reported as **actively exploited in the wild**, increasing urgency for defenders to deploy the July updates. Microsoft also published advisories for additional vulnerabilities including **`CVE-2024-38023`**, **`CVE-2024-38060`**, **`CVE-2024-38074`**, and **`CVE-2024-38076`**, underscoring the breadth of the release and the need for rapid patching across enterprise Microsoft environments.
Jul 24, 2026