Loading story…
Microsoft released its March 2025 security updates to address 58 vulnerabilities across Windows, Office, Azure components, Visual Studio, and related enterprise software, including 23 remote code execution flaws and six critical vulnerabilities. The most severe issues affected Microsoft Office, Microsoft Dataverse, Windows Remote Desktop Services, Remote Desktop Client, Windows DNS, and Windows Subsystem for Linux 2, with impacts ranging from remote code execution to privilege escalation.
The update also remediated several vulnerabilities reported as actively exploited, including CVE-2025-24983 in the Windows Win32 Kernel Subsystem, alongside flaws in Microsoft Management Console, Windows NTFS, and the Windows Fast FAT File System Driver. Microsoft said the Dataverse issue CVE-2025-24053 was mitigated automatically and required no customer action, while defenders were urged to deploy the broader patch bundle promptly to reduce exposure across supported Windows client and server environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued its March 2025 Patch Tuesday security updates addressing 58 vulnerabilities across its product portfolio, including six critical flaws and 23 remote code execution issues. The updates covered products including Microsoft Office, Dataverse, Windows Remote Desktop Services, Remote Desktop Client, Windows DNS, and Windows Subsystem for Linux 2.
Microsoft stated that the Microsoft Dataverse vulnerability CVE-2025-24053 was automatically remediated by the company and required no customer action. The flaw was included in reporting around the March 2025 security updates.
In conjunction with the March 2025 updates, Microsoft disclosed that several vulnerabilities were being actively exploited, including CVE-2025-24983 in the Windows Win32 Kernel Subsystem as well as flaws affecting Microsoft Management Console, Windows NTFS, and the Windows Fast FAT File System Driver. This marked the vulnerabilities as in-the-wild threats requiring urgent patching.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its February 2025 security updates to address **61 vulnerabilities** across Windows, Office, SharePoint, Edge, Visual Studio, CBL Mariner, and other products. The bundle included **26 remote code execution flaws** and **four critical vulnerabilities**, with notable high-risk issues affecting **Microsoft Dynamics 365 Sales**, **Microsoft Excel**, **Windows LDAP**, and the **Windows DHCP Client Service**. Microsoft also published individual advisories for vulnerabilities including `CVE-2025-21376` and `CVE-2025-21177` as part of the release. The update cycle also fixed **two actively exploited zero-days**: `CVE-2025-21391` in **Windows Storage** and `CVE-2025-21418` in the **Windows Ancillary Function Driver for WinSock**. Security guidance accompanying the release urged organizations to prioritize deployment of the February patch bundle because the affected components are widely used across enterprise Windows environments and Microsoft application stacks.
Jul 24, 2026
Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.
Jun 29, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026