Loading story…
Microsoft released its December security updates to address 72 vulnerabilities across Windows, Office, SharePoint, Microsoft 365 Apps, System Center Operations Manager, and related platforms, including 31 remote code execution flaws. The most severe issues affect Windows Remote Desktop Services and Client, Windows LDAP, Hyper-V, Microsoft Message Queuing, and LSASS, with multiple bugs rated critical because they could allow remote compromise of affected systems.
The update bundle also fixes CVE-2024-49138, a privilege-escalation flaw in the Windows Common Log File System Driver (CLFS) that was reported as actively exploited in the wild and could let an authenticated attacker gain SYSTEM privileges. Microsoft published the release through its Security Update Guide and Mariner release notes, while defenders were urged to prioritize rapid deployment of the December patches to reduce exposure to both active exploitation and high-impact remote code execution risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The December 2024 Microsoft security update notice highlighted CVE-2024-49138 in the Windows Common Log File System Driver as actively exploited in the wild. The flaw allows an authenticated attacker to escalate privileges to SYSTEM.
Microsoft issued its December 2024 Patch Tuesday updates, addressing 72 vulnerabilities across its product portfolio, including 17 critical flaws and 31 remote code execution issues. The affected products include Windows desktop and server versions, Office, SharePoint, Microsoft 365 Apps, and System Center Operations Manager.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **71 CVEs** across 10 product families, including **17 Critical** and **54 Important** vulnerabilities, with the update heavily concentrated on Windows. The most severe issue was **`CVE-2024-49112`**, a **CVSS 9.8** remote code execution flaw in **LDAP** affecting supported Windows client and server versions back to **Windows Server 2008**, while multiple other patches addressed remote code execution risks in **Remote Desktop Services** and additional Windows components. Microsoft also fixed an **actively exploited zero-day**, **`CVE-2024-49138`**, in the **Windows Common Log File System Driver (CLFS)**, and identified six more vulnerabilities as more likely to be exploited within 30 days. Those higher-risk issues affected **SharePoint, MSMQ, ReFS, and several Windows drivers**, underscoring broad exposure across enterprise environments; Sophos said protections were available for five of the patched vulnerabilities, and noted Microsoft patched **1,015 CVEs** through Patch Tuesday during 2024, the company’s highest annual total since 2020.
Jun 29, 2026
Microsoft released its February 2025 security updates to address **61 vulnerabilities** across Windows, Office, SharePoint, Edge, Visual Studio, CBL Mariner, and other products. The bundle included **26 remote code execution flaws** and **four critical vulnerabilities**, with notable high-risk issues affecting **Microsoft Dynamics 365 Sales**, **Microsoft Excel**, **Windows LDAP**, and the **Windows DHCP Client Service**. Microsoft also published individual advisories for vulnerabilities including `CVE-2025-21376` and `CVE-2025-21177` as part of the release. The update cycle also fixed **two actively exploited zero-days**: `CVE-2025-21391` in **Windows Storage** and `CVE-2025-21418` in the **Windows Ancillary Function Driver for WinSock**. Security guidance accompanying the release urged organizations to prioritize deployment of the February patch bundle because the affected components are widely used across enterprise Windows environments and Microsoft application stacks.
Jul 24, 2026
Microsoft released its January 2025 security updates to fix **161 vulnerabilities** across its product portfolio, including **58 remote code execution** flaws and **12 critical** issues. The update covers high-risk weaknesses in **Windows OLE**, **Windows RMCAST**, **Windows NTLM v1**, **Azure Marketplace SaaS Resources**, **Microsoft Purview**, **Microsoft Excel**, **Remote Desktop Services**, **Digest Authentication**, **NEGOEX**, and **BranchCache**, according to Microsoft’s release notes and CSIRT.SK. The most urgent issues are three **Windows Hyper-V NT Kernel Integration VSP** privilege-escalation vulnerabilities — `CVE-2025-21333`, `CVE-2025-21334`, and `CVE-2025-21335` — which were reported as **actively exploited in the wild**. Defenders were urged to deploy the January patch bundle quickly, with additional mitigations noted for some exposures, including using plaintext mode in Outlook, restricting exposed PGM ports, and disabling **NTLMv1** by setting `LmCompatibilityLevel` to `5`.
Jul 24, 2026