Microsoft Fixes 90 Flaws Including Six Actively Exploited Windows Vulnerabilities

Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.

May 13, 2026

Microsoft Fixes 58 Flaws Including Six Critical RCE Bugs and Actively Exploited Windows Issues

Microsoft released its March 2025 security updates to address **58 vulnerabilities** across Windows, Office, Azure components, Visual Studio, and related enterprise software, including **23 remote code execution** flaws and **six critical vulnerabilities**. The most severe issues affected **Microsoft Office**, **Microsoft Dataverse**, **Windows Remote Desktop Services**, **Remote Desktop Client**, **Windows DNS**, and **Windows Subsystem for Linux 2**, with impacts ranging from remote code execution to privilege escalation. The update also remediated several vulnerabilities reported as **actively exploited**, including `CVE-2025-24983` in the **Windows Win32 Kernel Subsystem**, alongside flaws in **Microsoft Management Console**, **Windows NTFS**, and the **Windows Fast FAT File System Driver**. Microsoft said the **Dataverse** issue `CVE-2025-24053` was mitigated automatically and required no customer action, while defenders were urged to deploy the broader patch bundle promptly to reduce exposure across supported Windows client and server environments.

Jan 24, 2026

Microsoft Fixes 61 Flaws Including 4 Critical Bugs and 2 Zero-Days in Windows

Microsoft released its February 2025 security updates to address **61 vulnerabilities** across Windows, Office, SharePoint, Edge, Visual Studio, CBL Mariner, and other products. The bundle included **26 remote code execution flaws** and **four critical vulnerabilities**, with notable high-risk issues affecting **Microsoft Dynamics 365 Sales**, **Microsoft Excel**, **Windows LDAP**, and the **Windows DHCP Client Service**. Microsoft also published individual advisories for vulnerabilities including `CVE-2025-21376` and `CVE-2025-21177` as part of the release. The update cycle also fixed **two actively exploited zero-days**: `CVE-2025-21391` in **Windows Storage** and `CVE-2025-21418` in the **Windows Ancillary Function Driver for WinSock**. Security guidance accompanying the release urged organizations to prioritize deployment of the February patch bundle because the affected components are widely used across enterprise Windows environments and Microsoft application stacks.

Jan 25, 2026

Microsoft Fixes 90 Flaws Including Six Actively Exploited Windows Vulnerabilities

How this story unfolded

Microsoft releases August 2024 Patch Tuesday fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Microsoft Fixes 90 Flaws Including Six Actively Exploited Windows Vulnerabilities

How this story unfolded

Microsoft releases August 2024 Patch Tuesday fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Microsoft Fixes 90 Flaws Including Six Actively Exploited Windows Vulnerabilities

How this story unfolded

Microsoft releases August 2024 Patch Tuesday fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Fixes 137 Flaws Led by Netlogon, DNS Client, and Dynamics 365 RCEs

Microsoft Fixes 58 Flaws Including Six Critical RCE Bugs and Actively Exploited Windows Issues

Microsoft Fixes 61 Flaws Including 4 Critical Bugs and 2 Zero-Days in Windows

Microsoft Fixes 90 Flaws Including Six Actively Exploited Windows Vulnerabilities

How this story unfolded

Microsoft releases August 2024 Patch Tuesday fixes

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Microsoft Fixes 137 Flaws Led by Netlogon, DNS Client, and Dynamics 365 RCEs

Microsoft Fixes 58 Flaws Including Six Critical RCE Bugs and Actively Exploited Windows Issues

Microsoft Fixes 61 Flaws Including 4 Critical Bugs and 2 Zero-Days in Windows