Loading story…
Microsoft patched multiple actively exploited vulnerabilities across Windows, Outlook, Office, and Exchange Server, including the Outlook flaw CVE-2024-21413 and the Exchange Server issue CVE-2024-21410. The February Patch Tuesday release addressed 73 vulnerabilities in total, with five rated critical, and included fixes for additional zero-days such as CVE-2024-21412 involving Internet Shortcut/LNK files and CVE-2024-21351, a security feature bypass used in attacks.
The Outlook vulnerability CVE-2024-21413 stems from improper parsing of file:// links, allowing attackers to bypass Protected View, leak NTLM credentials, and potentially achieve remote code execution. In Exchange Server, CVE-2024-21410 allows an unauthenticated attacker to capture and relay Net-NTLMv2 authentication material; defenders were urged to apply Microsoft’s security updates immediately and enable Extended Protection for Authentication on Exchange systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft's February 2024 Patch Tuesday included a fix for CVE-2024-21413, an Outlook vulnerability that could bypass Protected View via improper parsing of file:// links. The same reporting states the flaw was being actively exploited and could expose NTLM credentials and potentially enable remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released security updates for 203 vulnerabilities across its product portfolio, including 33 rated **critical**, and patched six **zero-day** flaws. One of the zero-days, `CVE-2026-42897`, was reported as actively exploited in the wild; it affects **Microsoft Exchange Server** and allows spoofing through an input-sanitization weakness that can trigger JavaScript execution in the **Outlook on the web** context when a crafted email is opened. The update set also addressed multiple Windows zero-days, including the **Windows BitLocker Security Feature Bypass Vulnerability** tracked as `CVE-2026-45585`. According to public reporting, the Windows flaws span components such as **CTFMON**, **HTTP.sys**, **BitLocker**, and the **Cloud Files Mini Filter Driver**, with impacts including privilege escalation, denial of service, security feature bypass, and potential access to encrypted data. Microsoft urged organizations to deploy the patches promptly to reduce exposure.
Jul 24, 2026
Microsoft disclosed and patched multiple **actively exploited** vulnerabilities as part of its February security updates, including a Microsoft Word security feature bypass tracked as **CVE-2026-21514**. The Word flaw (CVSS 7.8; CWE-807) allows attackers to bypass **Object Linking and Embedding (OLE)**-related mitigations by abusing how Word makes security decisions based on untrusted inputs; exploitation is described as requiring a crafted document and **user interaction** (e.g., opening a phishing-delivered file) while avoiding typical prompts such as Protected View or “Enable Content” warnings. Microsoft also addressed an in-the-wild exploited Windows **Desktop Window Manager (dwm.exe)** elevation-of-privilege vulnerability, **CVE-2026-21519** (CVSS 7.8), which can allow a **local** attacker to escalate from a standard user context to **SYSTEM**. The February update review also lists additional exploited issues patched in the same release, including security feature bypasses in **Windows Shell (CVE-2026-21510)** and **Internet Explorer (CVE-2026-21513)**, plus other exploited vulnerabilities (e.g., **Windows Remote Desktop Services EoP CVE-2026-21533**), underscoring that defenders should prioritize rapid deployment of the February fixes across affected Windows and Office estates.
Jun 29, 2026
Microsoft released its January 2025 security updates to fix **161 vulnerabilities** across its product portfolio, including **58 remote code execution** flaws and **12 critical** issues. The update covers high-risk weaknesses in **Windows OLE**, **Windows RMCAST**, **Windows NTLM v1**, **Azure Marketplace SaaS Resources**, **Microsoft Purview**, **Microsoft Excel**, **Remote Desktop Services**, **Digest Authentication**, **NEGOEX**, and **BranchCache**, according to Microsoft’s release notes and CSIRT.SK. The most urgent issues are three **Windows Hyper-V NT Kernel Integration VSP** privilege-escalation vulnerabilities — `CVE-2025-21333`, `CVE-2025-21334`, and `CVE-2025-21335` — which were reported as **actively exploited in the wild**. Defenders were urged to deploy the January patch bundle quickly, with additional mitigations noted for some exposures, including using plaintext mode in Outlook, restricting exposed PGM ports, and disabling **NTLMv1** by setting `LmCompatibilityLevel` to `5`.
Jul 24, 2026