Loading story…
Microsoft released its September 2025 Patch Tuesday updates to address 81 vulnerabilities across its product portfolio, including 8 critical flaws, 72 important issues, and one vulnerability without a severity rating. The release included fixes for two vulnerabilities that were already being actively exploited in the wild, prompting calls for immediate patching.
One of the exploited flaws, CVE-2025-55234, affects the SMB Server component and enables privilege escalation through relay attack techniques that can capture authentication data for unauthorized access. The second, CVE-2024-21907, affects versions earlier than 13.0.1 of the third-party Newtonsoft.Json library bundled with Microsoft SQL Server and can be exploited remotely without authentication to trigger a denial of service via a StackOverflow exception in JsonConvert.DeserializeObject. Microsoft also advised defenders to enable SMB Server Signing and SMB Server Extended Protection for Authentication as mitigations for the SMB issue, while warning that older devices may face compatibility problems.
See which actors are running it and whether you're in range.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft issued its September 2025 security updates, fixing 81 vulnerabilities across its product portfolio, including 8 critical flaws, 72 important flaws, and one without a severity rating. The release included fixes for two zero-day vulnerabilities that were being actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for **139 vulnerabilities** across Windows, Windows Server, SharePoint, SQL Server, Office, .NET, Azure CycleCloud, and Visual Studio, including **54 remote code execution flaws**, **5 critical issues**, and **4 zero-days**. The most severe vulnerabilities affected **Microsoft SharePoint Server**, the **Windows Imaging Component**, and the **Windows Remote Desktop Licensing Service**, expanding the risk of remote compromise, privilege escalation, spoofing, security feature bypass, unauthorized data access, and denial-of-service attacks. Two of the zero-days, **`CVE-2024-38080`** and **`CVE-2024-38112`**, were reported as **actively exploited in the wild**, increasing urgency for defenders to deploy the July updates. Microsoft also published advisories for additional vulnerabilities including **`CVE-2024-38023`**, **`CVE-2024-38060`**, **`CVE-2024-38074`**, and **`CVE-2024-38076`**, underscoring the breadth of the release and the need for rapid patching across enterprise Microsoft environments.
Jul 24, 2026
Microsoft released fixes for **79 vulnerabilities** across 11 product families, including **7 Critical** issues and multiple flaws already exploited or associated with exploited conditions. The most significant actively exploited bugs were **`CVE-2024-38014`** in **Windows Installer** and **`CVE-2024-38217`** in **Windows Mark of the Web**, while **`CVE-2024-43491`** in the **Windows Update servicing stack** was highlighted as a high-severity risk for supported **Windows 10 version 1507 LTSB** and **IoT Enterprise 2015 LTSB** systems. Windows accounted for **47** of the patched CVEs, with **SQL Server** receiving fixes for **13** vulnerabilities and **SharePoint** affected by several high-risk remote code execution flaws that Microsoft said were more likely to be exploited within 30 days. Microsoft also noted that **Windows 11 24H2** is affected by **29** CVEs, including two already exploited in the wild, and the release referenced three **Adobe** vulnerabilities, including **`CVE-2024-41869`**, a critical **Adobe Reader** use-after-free flaw for which a workable exploit was already available.
Jun 29, 2026
Microsoft released a broad security update covering roughly **398 to 421 vulnerabilities** across Windows, Office, Exchange, SharePoint, Azure, .NET, Teams, and other enterprise products, with **42 rated Critical**. The most urgent issue is **`CVE-2026-68820`**, an actively exploited elevation-of-privilege flaw in the Windows **`afd.sys`** Ancillary Function Driver for WinSock that can let an attacker with code execution gain **SYSTEM** privileges; reporting linked observed exploitation to **Lazarus** activity. Microsoft also addressed publicly disclosed flaws including **`CVE-2026-62832`**, and researchers warned it could be chained with the afd.sys bug for full system compromise. The release also fixes multiple high-impact server-side and enterprise-facing vulnerabilities, including critical or high-severity remote code execution bugs in **Windows iSCSI Target Service** (**`CVE-2026-65791`**, **`CVE-2026-65679`**), **Windows GDI+** (**`CVE-2026-62822`**), **Windows DHCP Server** (**`CVE-2026-62823`**), **Remote Desktop Client** (**`CVE-2026-62824`**), **Windows SMBv3 Server** (**`CVE-2026-62790`**, **`CVE-2026-62800`**), and **Microsoft Office** (**`CVE-2026-70130`**), alongside spoofing and privilege-escalation issues in **Azure Entra ID** (**`CVE-2026-62869`**), **Windows NAT** (**`CVE-2026-56179`**), **Exchange Server** (**`CVE-2026-62911`**), **.NET Framework** (**`CVE-2026-62872`**), and **Windows DNS** (**`CVE-2026-62778`**). Microsoft also completed remediation of an on-premises **SharePoint** exploit chain by patching **`CVE-2026-63520`** after July’s fix for **`CVE-2026-55040`**, prompting defenders to prioritize the exploited kernel flaw, exposed network services, and fully update SharePoint farms.
Aug 25, 2026