Loading story…
Microsoft patched CVE-2024-38061, an Important-severity Windows DCOM vulnerability that could let low-privileged users remotely activate a DCOM application on a domain controller and coerce NTLM authentication from a privileged interactive user. The issue affected scenarios in which members of groups such as Distributed COM Users or Performance Log Users could trigger sppui/slui.exe under the logged-on user’s context, potentially targeting Domain Administrator sessions.
An attacker could capture the coerced authentication and relay it to services such as SMB, including systems supporting Active Directory Certificate Services (AD CS), to obtain further privileges. Researchers demonstrated a path from relayed authentication to compromise of an AD CS server and ultimately Domain Admin access through certificate abuse; organizations should apply Microsoft’s update and treat the affected DCOM group memberships as Tier 0 privileges, while using protections such as Protected Users for administrative accounts to reduce NTLM-relay exposure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers submitted alleged Task Scheduler credential-based UAC-bypass and task-metadata log-poisoning findings to MSRC. MSRC reportedly said RegistrationInfo metadata is general descriptive data and did not consider the reported findings vulnerabilities.
Microsoft fixed the DCOM permissions bug during the July 2024 Patch Tuesday release and assigned it CVE-2024-38061 with an Important severity rating.
MSRC initially classified the DCOM issue as a critical fix, then downgraded its assessment to moderate severity and did not immediately service it.
A researcher disclosed a Windows DCOM permissions issue involving the sppui/slui.exe DCOM application to Microsoft Security Response Center. The issue allowed members of Distributed COM Users or Performance Log Users to remotely activate the object and coerce authentication from an interactive privileged user.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cymulate.com
Open sourcedecoder.cloud
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026
Microsoft disclosed critical vulnerabilities in the Windows `RPCSS` service used for DCOM activation, including buffer overruns that let remote attackers send malformed RPC messages and execute arbitrary code with **Local System** privileges. The flaws affected Windows NT 4.0, Windows 2000, Windows XP, and Windows Server 2003, and Microsoft said the updated fix in **MS03-039** superseded earlier patches from **MS03-026** and **MS01-048** while also addressing a denial-of-service issue in the same component. Security researchers and network defenders reported that the DCOM-related RPC weakness, primarily exposed over **TCP/UDP 135**, was already being scanned and exploited in the wild, with underground exploit code in circulation and additional concern around **TCP 593** and COM Internet Services exposure. Microsoft and ISS urged organizations to deploy the patch immediately and reduce exposure by filtering affected RPC/DCOM ports, disabling COM Internet Services and RPC over HTTP where possible, using host firewalls or IPsec filters, and disabling DCOM on systems that did not require it.
Jun 29, 2026
Two separate Windows authentication weaknesses were highlighted as enabling high-impact **Active Directory** compromise via relay-style attacks. One issue, **CVE-2025-33073**, affects Windows **SMB client** authentication and enables **NTLM reflection**: attackers can coerce `lsass.exe` (running as **SYSTEM**) to authenticate to attacker-controlled infrastructure using techniques such as *PetitPotam*, *DFSCoerce*, and *Printerbug*, then relay/reflect that authentication to gain SYSTEM-level access and potentially full domain compromise. Reporting emphasized that despite a June 2025 patch, the condition remains widely present in enterprise environments due to incomplete patch adoption, and exploitation can be enabled with relatively low prerequisites such as the ability to register a malicious AD DNS record (often permitted to Authenticated Users by default) or to perform local DNS poisoning. A second technique described a **Kerberos relay** vector that abuses how Windows clients process **DNS CNAME** responses when building the SPN for TGS requests, allowing an on-path attacker (e.g., via ARP poisoning or DHCPv6/mitm6) to redirect victims to attacker-controlled services and obtain service tickets usable for relays and lateral movement. The write-up claims default configurations across Windows 10/11 and Windows Server 2022/2025 are susceptible, with potential impact including cross-protocol relays (e.g., HTTP→SMB/LDAP) and paths to RCE in some environments (e.g., via ADCS web enrollment scenarios). A separate Metasploit weekly wrap-up noted new and updated offensive modules (including AD privilege-escalation content), but it did not specifically tie to either of the two relay issues above.
Jun 30, 2026