Loading story…
Microsoft released its January 2025 security updates to fix 161 vulnerabilities across its product portfolio, including 58 remote code execution flaws and 12 critical issues. The update covers high-risk weaknesses in Windows OLE, Windows RMCAST, Windows NTLM v1, Azure Marketplace SaaS Resources, Microsoft Purview, Microsoft Excel, Remote Desktop Services, Digest Authentication, NEGOEX, and BranchCache, according to Microsoft’s release notes and CSIRT.SK.
The most urgent issues are three Windows Hyper-V NT Kernel Integration VSP privilege-escalation vulnerabilities — CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335 — which were reported as actively exploited in the wild. Defenders were urged to deploy the January patch bundle quickly, with additional mitigations noted for some exposures, including using plaintext mode in Outlook, restricting exposed PGM ports, and disabling NTLMv1 by setting LmCompatibilityLevel to 5.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued its January 2025 Patch Tuesday security updates, addressing 161 vulnerabilities across its product portfolio, including 58 remote code execution flaws and 12 critical vulnerabilities.
The January 2025 advisory identified CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335 in Windows Hyper-V NT Kernel Integration VSP as privilege-escalation vulnerabilities that were actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for 172 vulnerabilities across Windows, Office, Exchange, SharePoint, .NET, Visual Studio, PowerShell, and Windows Server, with **8 rated critical** and **162 rated important**. The company said **6 vulnerabilities were actively exploited in the wild**, including Windows privilege-escalation flaws affecting the **Agere Modem native driver** and **Windows Remote Access Connection Manager**, while critical issues in the release included remote code execution and privilege-escalation risks. The update set also referenced related security issues involving **IGEL OS Secure Boot**, **AMD EPYC SEV-SNP**, and the **TCG TPM 2.0** specification, with Microsoft still working on mitigations for Azure Confidential Computing exposure tied to the AMD issue. Microsoft’s Security Update Guide included advisory **`CVE-2025-24990`**, and defenders were urged to deploy patches through standard Microsoft update channels and review product-specific guidance immediately.
Jul 24, 2026
Microsoft released fixes for **117 vulnerabilities** across 15 product families, including **3 Critical**, **110 Important**, **3 Moderate**, and **1 Low** severity issues. Two flaws were already being exploited in the wild: `CVE-2024-43572` in **Microsoft Management Console** and `CVE-2024-43573` in the **Windows MSHTML Platform**. Microsoft also flagged eight additional vulnerabilities as more likely to be exploited within 30 days, while Windows accounted for the vast majority of the exposure with **93 CVEs** spanning remote code execution, elevation of privilege, and denial-of-service bugs. The most severe issues included `CVE-2024-43468`, a **Critical Microsoft Configuration Manager remote code execution** flaw with a **CVSS 9.8** score that requires an in-console update and additional hardening, and `CVE-2024-38124`, a **Windows Netlogon elevation of privilege** vulnerability with mitigation guidance. The release also addressed 15 Windows Mobile Broadband Driver flaws that generally require physical access or proximity, Windows 11 24H2-specific bugs such as `CVE-2024-43527` and `CVE-2024-43571`, and advisory items affecting Edge and curl-related components; Sophos said protections were available for `CVE-2024-43502`, `CVE-2024-43572`, and `CVE-2024-43573`.
Jun 29, 2026
Microsoft released its December security updates to address **72 vulnerabilities** across Windows, Office, SharePoint, Microsoft 365 Apps, System Center Operations Manager, and related platforms, including **31 remote code execution** flaws. The most severe issues affect **Windows Remote Desktop Services and Client**, **Windows LDAP**, **Hyper-V**, **Microsoft Message Queuing**, and **LSASS**, with multiple bugs rated critical because they could allow remote compromise of affected systems. The update bundle also fixes **`CVE-2024-49138`**, a privilege-escalation flaw in the **Windows Common Log File System Driver (CLFS)** that was reported as **actively exploited in the wild** and could let an authenticated attacker gain **SYSTEM** privileges. Microsoft published the release through its Security Update Guide and Mariner release notes, while defenders were urged to prioritize rapid deployment of the December patches to reduce exposure to both active exploitation and high-impact remote code execution risks.
Jul 24, 2026