Loading story…
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with CVE-2024-30040 and CVE-2024-30051 confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a Windows MSHTML Platform security feature bypass and a Windows DWM Core Library elevation-of-privilege flaw that can allow attackers to gain SYSTEM privileges.
Researchers who reported CVE-2024-30051 said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with QakBot and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2024-05-16, CSIRT.SK published guidance noting that Microsoft's May 2024 updates fixed 61 vulnerabilities, including actively exploited zero-days CVE-2024-30040 and CVE-2024-30051, and urged immediate deployment of the patches.
In mid-April 2024, researchers found an in-the-wild exploit for CVE-2024-30051 being used alongside QakBot and other malware. They assessed that multiple threat actors likely had access to the exploit.
In early April 2024, researchers examining a suspicious VirusTotal-uploaded document identified and validated a real Windows Desktop Window Manager privilege-escalation zero-day that could grant SYSTEM privileges. They reported the issue to Microsoft, which later assigned it CVE-2024-30051.
On 2024-05-14, Microsoft released a security update for the Windows DWM Core Library Elevation of Privilege vulnerability CVE-2024-30051 as part of its May 2024 Patch Tuesday. The flaw was reported as actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesecurelist.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026
Microsoft released fixes for 63 vulnerabilities across its product portfolio, including five rated **critical** and one actively exploited zero-day. The exploited flaw, tracked as **`CVE-2025-62215`**, is a Windows kernel double-free race condition that enables **local privilege escalation** to **SYSTEM** without user interaction, according to Microsoft’s Security Update Guide and CSIRT.SK reporting. The November 2025 updates also addressed additional high-severity issues spanning **Windows**, **Microsoft Office**, **Visual Studio**, **Microsoft Graphics Component (GDI+)**, and **Nuance PowerScribe 360**, with impacts including **remote code execution**, **information disclosure**, and **privilege escalation**. Security advisories for vulnerabilities including **`CVE-2025-60716`** and **`CVE-2025-62215`** were published through Microsoft’s update channels, and defenders were urged to deploy the patches promptly because one flaw was already being exploited in the wild.
Jul 24, 2026
Microsoft released security updates addressing **149 vulnerabilities** across Windows and other products, including **67 remote code execution flaws**, **3 critical issues**, and two zero-days that were already being exploited in the wild. The actively exploited bugs were tracked as **`CVE-2024-29988`**, a Windows SmartScreen security feature bypass with a **CVSS 8.8**, and **`CVE-2024-26234`**, a spoofing vulnerability with a **CVSS 6.7**. Reports said **Water Hydra** abused `CVE-2024-29988` to deliver malicious files, while `CVE-2024-26234` was identified during analysis of a malicious proxy driver operating as a backdoor and signed with a valid **Microsoft Windows Hardware Compatibility Publisher** certificate. Microsoft published the fixes as part of its March/April 2024 security release materials, and defenders were urged to deploy the updates quickly across affected Microsoft environments.
Jul 24, 2026