Loading story…
Microsoft released security updates addressing 79 vulnerabilities across its product portfolio, including 19 remote code execution flaws and several issues already under active exploitation. The most severe bug, CVE-2024-43491, is a Windows Update use-after-free vulnerability with a CVSS 9.8 rating that can allow unauthenticated remote code execution. Critical vulnerabilities were also reported in Microsoft SharePoint Server, Azure Web Apps, Azure Stack Hub, and Windows Network Address Translation, expanding the risk beyond endpoint systems to server and cloud-connected environments.
Microsoft and third-party reporting said attackers were already exploiting CVE-2024-38014 in Windows Installer, CVE-2024-38217 in Mark of the Web, CVE-2024-38226 in Microsoft Publisher, and CVE-2024-43491 in Windows Update. The updates were published through Microsoft’s Security Update Guide and release notes, including related Mariner release information, and organizations were urged to prioritize deployment because the exploited flaws span privilege escalation and remote code execution paths across multiple supported Windows versions and Microsoft products.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In the September 2024 security update materials, Microsoft identified CVE-2024-43491, a critical Windows Update use-after-free vulnerability, as actively exploited in the wild. The flaw carries a CVSS score of 9.8 and can allow unauthenticated remote code execution.
Microsoft issued its September 2024 security updates addressing 79 vulnerabilities across its product portfolio, including seven critical flaws and 19 remote code execution issues. The updates included fixes for CVE-2024-43491 and other vulnerabilities affecting Windows, SharePoint Server, Azure Web Apps, Azure Stack Hub, and additional products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for **139 vulnerabilities** across Windows, Windows Server, SharePoint, SQL Server, Office, .NET, Azure CycleCloud, and Visual Studio, including **54 remote code execution flaws**, **5 critical issues**, and **4 zero-days**. The most severe vulnerabilities affected **Microsoft SharePoint Server**, the **Windows Imaging Component**, and the **Windows Remote Desktop Licensing Service**, expanding the risk of remote compromise, privilege escalation, spoofing, security feature bypass, unauthorized data access, and denial-of-service attacks. Two of the zero-days, **`CVE-2024-38080`** and **`CVE-2024-38112`**, were reported as **actively exploited in the wild**, increasing urgency for defenders to deploy the July updates. Microsoft also published advisories for additional vulnerabilities including **`CVE-2024-38023`**, **`CVE-2024-38060`**, **`CVE-2024-38074`**, and **`CVE-2024-38076`**, underscoring the breadth of the release and the need for rapid patching across enterprise Microsoft environments.
Jul 24, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026