Loading story…
Microsoft’s November 2024 security updates patched 89 vulnerabilities, including 52 remote code execution flaws and several critical issues across Windows, .NET, Visual Studio, Exchange Server, and Active Directory Certificate Services (AD CS). Among the most notable fixes was CVE-2024-49019, an AD CS privilege escalation bug tied to insecure certificate template configurations, alongside actively exploited flaws CVE-2024-43451 in Windows NT LAN Manager and CVE-2024-49039 in Windows Task Scheduler. Other critical vulnerabilities addressed included CVE-2024-43498 in .NET and Visual Studio, CVE-2024-43625 in Windows VMSwitch, CVE-2024-43639 in Windows Kerberos, and CVE-2024-49056 affecting airlift.microsoft.com.
Research published alongside the updates highlighted how AD CS abuse can extend beyond previously cataloged escalation chains, describing an EKUwu technique that leverages certificate Extended Key Usage handling to obtain unintended privileges in misconfigured environments. The findings reinforced that organizations running AD CS face elevated risk when certificate templates are loosely controlled, and they underscored Microsoft’s guidance to rapidly deploy the November patches and review certificate template settings to reduce exposure to privilege escalation and identity compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft's November 2024 security updates addressed CVE-2024-49019, an Active Directory Certificate Services privilege-escalation flaw that can be exploited when certificate templates are configured insecurely. The same patch bundle covered 89 vulnerabilities across Microsoft's product portfolio.
TrustedSec published a blog post analyzing EKUwu, describing why CVE-2024-49019 in AD CS is more than another ESC-style issue. This represents a public technical disclosure and deeper explanation of the vulnerability's exploitation conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026
Microsoft disclosed and patched **`CVE-2026-25177`**, an **Active Directory Domain Services (AD DS) Elevation of Privilege** vulnerability, through its Security Update Guide. The issue affects a core identity service used across Windows enterprise environments, where successful exploitation could allow an attacker to gain higher privileges within an AD-managed domain and increase control over affected systems or directory operations. The new advisory follows earlier Microsoft fixes for similar AD DS privilege-escalation bugs, including **`CVE-2022-34691`** and **`CVE-2021-42287`**, underscoring the continued security risk around domain controller and directory service weaknesses. Organizations running AD DS should prioritize Microsoft’s security updates, assess exposure across domain controllers, and review privileged account activity for signs of attempted abuse tied to elevation-of-privilege paths in Active Directory.
Jul 12, 2026
Microsoft released its December security updates to address **72 vulnerabilities** across Windows, Office, SharePoint, Microsoft 365 Apps, System Center Operations Manager, and related platforms, including **31 remote code execution** flaws. The most severe issues affect **Windows Remote Desktop Services and Client**, **Windows LDAP**, **Hyper-V**, **Microsoft Message Queuing**, and **LSASS**, with multiple bugs rated critical because they could allow remote compromise of affected systems. The update bundle also fixes **`CVE-2024-49138`**, a privilege-escalation flaw in the **Windows Common Log File System Driver (CLFS)** that was reported as **actively exploited in the wild** and could let an authenticated attacker gain **SYSTEM** privileges. Microsoft published the release through its Security Update Guide and Mariner release notes, while defenders were urged to prioritize rapid deployment of the December patches to reduce exposure to both active exploitation and high-impact remote code execution risks.
Jul 24, 2026