Loading story…
Microsoft released its February 2025 security updates to address 61 vulnerabilities across Windows, Office, SharePoint, Edge, Visual Studio, CBL Mariner, and other products. The bundle included 26 remote code execution flaws and four critical vulnerabilities, with notable high-risk issues affecting Microsoft Dynamics 365 Sales, Microsoft Excel, Windows LDAP, and the Windows DHCP Client Service. Microsoft also published individual advisories for vulnerabilities including CVE-2025-21376 and CVE-2025-21177 as part of the release.
The update cycle also fixed two actively exploited zero-days: CVE-2025-21391 in Windows Storage and CVE-2025-21418 in the Windows Ancillary Function Driver for WinSock. Security guidance accompanying the release urged organizations to prioritize deployment of the February patch bundle because the affected components are widely used across enterprise Windows environments and Microsoft application stacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft made individual Security Update Guide entries available for CVE-2025-21177 and CVE-2025-21376 as part of the February 2025 security update coverage. These entries document the vulnerabilities in Microsoft's advisory system.
Microsoft's February 2025 security updates addressed 61 vulnerabilities across its product portfolio, including 26 remote code execution flaws. The release included fixes for critical issues in Microsoft Dynamics 365 Sales, Microsoft Excel, Windows LDAP, and the Windows DHCP Client Service.
In the February 2025 update cycle, Microsoft identified two vulnerabilities as already being actively exploited: CVE-2025-21391 in Windows Storage and CVE-2025-21418 in the Windows Ancillary Function Driver for WinSock. The advisory urged organizations to deploy the February patch bundle promptly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its March 2025 security updates to address **58 vulnerabilities** across Windows, Office, Azure components, Visual Studio, and related enterprise software, including **23 remote code execution** flaws and **six critical vulnerabilities**. The most severe issues affected **Microsoft Office**, **Microsoft Dataverse**, **Windows Remote Desktop Services**, **Remote Desktop Client**, **Windows DNS**, and **Windows Subsystem for Linux 2**, with impacts ranging from remote code execution to privilege escalation. The update also remediated several vulnerabilities reported as **actively exploited**, including `CVE-2025-24983` in the **Windows Win32 Kernel Subsystem**, alongside flaws in **Microsoft Management Console**, **Windows NTFS**, and the **Windows Fast FAT File System Driver**. Microsoft said the **Dataverse** issue `CVE-2025-24053` was mitigated automatically and required no customer action, while defenders were urged to deploy the broader patch bundle promptly to reduce exposure across supported Windows client and server environments.
Jul 24, 2026
Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.
Jun 29, 2026
Microsoft’s May 2026 Patch Tuesday resolved between **120 and 137 vulnerabilities** across Windows, Office, networking services, Hyper-V, SharePoint Server, and Microsoft Dynamics 365 on-premises, including **17 to 30 critical flaws**. Microsoft said the release contained **no publicly disclosed or actively exploited zero-days**, but multiple high-risk issues affected core enterprise infrastructure. Notable vulnerabilities included unauthenticated remote code execution in **Windows Netlogon** (`CVE-2026-41089`) and the **Windows DNS Client** (`CVE-2026-41096`), a **Hyper-V guest-to-host escape**, a SharePoint Server RCE (`CVE-2026-40365`), and a **Dynamics 365 on-premises** RCE (`CVE-2026-42898`) rated **CVSS 9.9**. The update also addressed Office and endpoint attack paths, including Microsoft Word flaws and `CVE-2026-35421`, which could allow code execution through malicious **EMF** files opened in Microsoft Paint via Windows GDI. Security researchers said organizations should prioritize patching **domain controllers**, **DNS-exposed Windows systems**, **on-premises collaboration platforms**, and **user endpoints** because of their exposure and likely exploitability. Alongside the security fixes, Microsoft issued mandatory Windows 11 cumulative updates **KB5089549** and **KB5087420** for versions **25H2, 24H2, and 23H2**, adding platform changes such as File Explorer, accessibility, storage, printing, and secure batch file processing improvements.
Jun 29, 2026