Loading story…
Microsoft released fixes for critical remote code execution vulnerabilities in the Windows RPC Runtime, including CVE-2022-26809, a flaw in rpcrt4.dll that could allow unauthenticated, zero-click code execution on vulnerable systems. Security reporting said the bug stemmed from an integer overflow that could lead to a heap buffer overflow during RPC processing, affecting both client-side and server-side code paths in Windows.
Researchers warned that unpatched systems exposing TCP port 445 were at particular risk, with internet scanning indicating that more than 700,000 Windows machines could be reachable and potentially vulnerable. Microsoft’s April security updates addressed the issue, while defenders were urged to apply patches, block external access to port 445, and restrict inbound connections to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
As of April 18, 2022, Shodan data cited in reporting showed more than 700,000 internet-exposed Windows machines with TCP port 445 open that were potentially vulnerable if unpatched. The count highlighted the broad exposure of systems affected by CVE-2022-26809.
Akamai researchers Ophir Harpaz and Ben Barnea published analysis of the critical Windows RPC runtime vulnerability CVE-2022-26809, describing how an integer overflow in rpcrt4.dll could lead to heap buffer overflow and remote code execution. The analysis also discussed mitigations such as restricting or blocking external access to TCP port 445.
Microsoft released April 2022 security updates that patched three critical vulnerabilities in the Windows RPC runtime, including CVE-2022-26809. The flaw could allow unauthenticated remote code execution on vulnerable systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
fourcore.io
Open sourceakamai.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-62781**, a high-severity remote code execution flaw in the Windows **RPC Runtime Library** that allows an unauthenticated attacker to execute code over the network. The heap-based buffer overflow, tracked as **CWE-122** and scored **CVSS 8.1**, affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012, 2016, 2019, 2022, and 2025, according to the CVE entry and Microsoft advisory. The exposure is notable because exploitation of remote services has repeatedly enabled rapid lateral movement and internal propagation across Windows environments. MITRE ATT&CK maps this activity to **`T1210`**, citing past abuse of SMB, Netlogon, RPC, and Print Spooler flaws by threats such as WannaCry, NotPetya, TrickBot, Conficker, and multiple intrusion groups; Splunk has also tied remote-service exploitation detections to the same technique in prior RCE-related content. Security teams are likely to treat the new RPC flaw as a priority patching issue given its network-reachable nature and the history of Windows remote-service vulnerabilities being used for enterprise-wide spread.
Aug 12, 2026
Microsoft published security advisories for multiple remote code execution vulnerabilities affecting **Remote Desktop Client**, **Remote Desktop Protocol**, and the **Remote Procedure Call (RPC) Runtime**. The referenced issues include `CVE-2025-58718` in the Remote Desktop Client, alongside earlier Microsoft advisories for `CVE-2022-21851` in the Remote Desktop Client, `CVE-2022-21893` in Remote Desktop Protocol, and `CVE-2022-21922` in the RPC Runtime. The advisories indicate continued security risk around core Windows remote access and interprocess communication components that are widely used in enterprise environments. For defenders, the common thread is exposure to **remote code execution** in services and clients tied to remote connectivity, making Microsoft’s security updates for these CVEs a priority for systems that rely on RDP and RPC functionality.
Jul 12, 2026
Microsoft disclosed critical vulnerabilities in the Windows `RPCSS` service used for DCOM activation, including buffer overruns that let remote attackers send malformed RPC messages and execute arbitrary code with **Local System** privileges. The flaws affected Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, and Microsoft said the updated fix in **MS03-039** superseded earlier patches from **MS03-026** and **MS01-048** while also addressing a denial-of-service issue in the same component. Security researchers and network defenders reported that the DCOM-related RPC weakness, primarily exposed over **TCP/UDP 135**, was already being scanned and exploited in the wild, with underground exploit code in circulation and additional concern around **TCP 593** and COM Internet Services exposure. Microsoft and ISS urged organizations to deploy the patch immediately and reduce exposure by filtering affected RPC/DCOM ports, disabling COM Internet Services and RPC over HTTP where possible, using host firewalls or IPsec filters, and disabling DCOM on systems that did not require it.
Jun 29, 2026