Loading story…
Microsoft released security updates addressing 149 vulnerabilities across Windows and other products, including 67 remote code execution flaws, 3 critical issues, and two zero-days that were already being exploited in the wild. The actively exploited bugs were tracked as CVE-2024-29988, a Windows SmartScreen security feature bypass with a CVSS 8.8, and CVE-2024-26234, a spoofing vulnerability with a CVSS 6.7.
Reports said Water Hydra abused CVE-2024-29988 to deliver malicious files, while CVE-2024-26234 was identified during analysis of a malicious proxy driver operating as a backdoor and signed with a valid Microsoft Windows Hardware Compatibility Publisher certificate. Microsoft published the fixes as part of its March/April 2024 security release materials, and defenders were urged to deploy the updates quickly across affected Microsoft environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft published the March 2024 Mariner release notes in its Security Update Guide. The reference indicates a security update release note event but does not provide an explicit event date in the supplied content.
CVE-2024-26234 was uncovered during analysis of a malicious proxy driver that functioned as a backdoor and was signed with a valid Microsoft Windows Hardware Compatibility Publisher certificate. Microsoft fixed the spoofing vulnerability as part of its April 2024 Patch Tuesday updates.
The actively exploited Windows SmartScreen security feature bypass CVE-2024-29988 was reported as used by the Water Hydra group to launch malicious files. This attribution was included in reporting on Microsoft's April 2024 security updates.
Microsoft's April 2024 Patch Tuesday updates fixed 149 vulnerabilities, including two zero-days reported as actively exploited in the wild: CVE-2024-29988 and CVE-2024-26234. The updates also addressed 67 remote code execution flaws and three critical issues across Windows and other Microsoft products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **79 vulnerabilities** across 11 product families, including **7 Critical** issues and multiple flaws already exploited or associated with exploited conditions. The most significant actively exploited bugs were **`CVE-2024-38014`** in **Windows Installer** and **`CVE-2024-38217`** in **Windows Mark of the Web**, while **`CVE-2024-43491`** in the **Windows Update servicing stack** was highlighted as a high-severity risk for supported **Windows 10 version 1507 LTSB** and **IoT Enterprise 2015 LTSB** systems. Windows accounted for **47** of the patched CVEs, with **SQL Server** receiving fixes for **13** vulnerabilities and **SharePoint** affected by several high-risk remote code execution flaws that Microsoft said were more likely to be exploited within 30 days. Microsoft also noted that **Windows 11 24H2** is affected by **29** CVEs, including two already exploited in the wild, and the release referenced three **Adobe** vulnerabilities, including **`CVE-2024-41869`**, a critical **Adobe Reader** use-after-free flaw for which a workable exploit was already available.
Jun 29, 2026
Microsoft released its February Patch Tuesday security updates addressing **~58–59 vulnerabilities** across Windows and other products, including **six zero-day flaws confirmed as actively exploited in the wild** and **five Critical** issues. Reported vulnerability classes were led by **Elevation of Privilege (25)**, followed by **Remote Code Execution (12)** and **Security Feature Bypass (5)**, with additional fixes for spoofing, information disclosure, DoS, and XSS; Microsoft also noted additional *Edge* fixes shipped outside the prior Patch Tuesday cadence, including an Android spoofing issue (`CVE-2026-0391`). One of the actively exploited zero-days highlighted across reporting is `CVE-2026-21510`, a **Windows Shell security feature bypass** that can be abused to evade **Mark-of-the-Web/SmartScreen-style warnings** by using specially crafted files (e.g., shortcut/link formats) so that untrusted content can execute without expected prompts, making it well-suited to phishing and social-engineering delivery. Separate coverage also noted Microsoft’s rollout of **updated Secure Boot certificates** ahead of the June 2026 expiration of legacy 2011 certificates, a change with broad implications for Windows boot integrity and enterprise device management.
Jun 29, 2026
Microsoft released security updates for **139 vulnerabilities** across Windows, Windows Server, SharePoint, SQL Server, Office, .NET, Azure CycleCloud, and Visual Studio, including **54 remote code execution flaws**, **5 critical issues**, and **4 zero-days**. The most severe vulnerabilities affected **Microsoft SharePoint Server**, the **Windows Imaging Component**, and the **Windows Remote Desktop Licensing Service**, expanding the risk of remote compromise, privilege escalation, spoofing, security feature bypass, unauthorized data access, and denial-of-service attacks. Two of the zero-days, **`CVE-2024-38080`** and **`CVE-2024-38112`**, were reported as **actively exploited in the wild**, increasing urgency for defenders to deploy the July updates. Microsoft also published advisories for additional vulnerabilities including **`CVE-2024-38023`**, **`CVE-2024-38060`**, **`CVE-2024-38074`**, and **`CVE-2024-38076`**, underscoring the breadth of the release and the need for rapid patching across enterprise Microsoft environments.
Jul 24, 2026