Exchange Server Archives

Winsage

July 16, 2026

Microsoft’s July patches fix over 600 flaws, shattering last month’s record

Microsoft has released its July 2026 Patch Tuesday updates, addressing 570 new security vulnerabilities, bringing the total for the month to over 620. The cumulative count of vulnerabilities patched this year has reached 1,380, exceeding the total of 1,250 for the entire year of 2020. Over 400 vulnerabilities are related to various versions of Windows, and the Windows 10 Extended Security Update program has been extended until October 12, 2027. Notable vulnerabilities include CVE-2026-56155 in Active Directory Federation Services, which allows attackers to gain administrator rights, and several critical Remote Code Execution vulnerabilities, including CVE-2026-57092 in Hyper-V and CVE-2026-56190 in Remote Desktop Protocol. Microsoft has also patched 97 vulnerabilities in Office products, with 17 classified as critical RCE vulnerabilities, and four vulnerabilities in Exchange Server, including CVE-2026-55008. The latest Microsoft Edge update addresses 27 vulnerabilities related to Chromium, and a vulnerability in Minecraft Bedrock servers has been patched.

Winsage

July 14, 2026

Microsoft rolls out massive Windows 11 security update with 416 fixes

Microsoft released its July 2026 Patch Tuesday cumulative updates for Windows 11, addressing numerous security vulnerabilities and enhancing Secure Boot functionalities. The updates include: - KB5101650 for Windows 11 25H2 and 24H2, updating systems to builds 26200.8875 and 26100.8875. - KB5101649 for Windows 11 26H1, updating devices to build 28000.2525. The release addresses a total of 622 Microsoft Common Vulnerabilities and Exposures (CVEs), including: - 416 vulnerabilities in Windows. - Fixes for Microsoft Office, Edge, Exchange Server, SharePoint Server, SQL Server, Defender, and Azure services. Key vulnerabilities fixed include: - CVE-2026-50661: A BitLocker Security Feature Bypass vulnerability. - CVE-2026-56155: An AD FS Elevation of Privilege vulnerability that has been exploited. - CVE-2026-56164: A SharePoint Server Elevation of Privilege vulnerability. The updates also introduce new Secure Boot certificates, rectify issues from previous patches affecting third-party applications, and incorporate curl 8.21.0 for security improvements. Users are advised to back up data before installation, which requires a system reboot.

Winsage

July 12, 2026

Microsoft is killing 15 products in 2026, including Windows 11 24H2 and Office 2021

Microsoft will discontinue support for several products in 2026, including: 1. Windows 11 24H2 (Home and Pro) - End of servicing on October 13, 2026. 2. Office 2021 and Office LTSC 2021 - End of support on October 13, 2026. 3. Windows Server 2012 and 2012 R2 - Final ESU year ending on October 13, 2026. 4. SQL Server 2016 - Extended end of support on July 14, 2026. 5. SharePoint Server 2016 and 2019, Project Server 2016 and 2019 - Support ends on July 14, 2026. 6. Microsoft Publisher - Retired after October 2026. 7. Exchange Server 2016 and 2019, Skype for Business Server - Final ESU cutoff on October 31, 2026. 8. Windows 11 Enterprise and Education 23H2, .NET 8, .NET 9, PowerShell 7.4 - End of servicing on November 10, 2026. 9. Windows 10 2016 LTSB and IoT Enterprise LTSB 2016 - Extended support ends on October 13, 2026. 10. Windows 11 SE - Support ends on October 1, 2026. 11. Dynamics CRM 2016 and older versions - Lost support earlier in January 2026. 12. Microsoft Configuration Manager, version 2409 - End of support on June 6, 2026. 13. Visual Studio 2022 LTSC channels, versions 17.10 and 17.12 - End of support in January and July 2026, respectively. 14. InfoPath 2013, SharePoint Designer 2013 - End of support on July 14, 2026. 15. Azure service retirements - Occurring in late 2026. Organizations are advised to review their software landscape and plan for transitions to avoid disruptions.

Winsage

June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.

Winsage

June 11, 2026

Microsoft patches a record 206 flaws—and one is already being exploited

Microsoft patched 206 vulnerabilities during June's Patch Tuesday, surpassing the previous record of 175 vulnerabilities patched in October 2025. Among the patched vulnerabilities, 118 are related to different versions of Windows, including Windows 10, Windows 11, and Windows Server. One critical vulnerability, CVE-2026-41091, in Microsoft Defender is actively being exploited, prompting an update to the Malware Protection Engine. Microsoft also addressed ten vulnerabilities in the Security Feature Bypass category due to the expiration of old Secure Boot certificates. Of the 118 Windows vulnerabilities, 19 are classified as critical Remote Code Execution (RCE) vulnerabilities, including CVE-2026-47288 and CVE-2026-47291. In Microsoft Office, 54 vulnerabilities were patched, including 25 RCE vulnerabilities, with nine classified as critical. Microsoft patched eight vulnerabilities in Exchange Server, including CVE-2026-45583, which can be exploited in a man-in-the-middle scenario. Additionally, the update for Edge addressed 74 Chromium vulnerabilities, including a zero-day vulnerability (CVE-2026-11645).

Winsage

May 20, 2026

How To Mitigate The Microsoft Windows BitLocker ‘Angry Hacker’ 0-Day

Microsoft is addressing a zero-day exploit known as YellowKey, identified as CVE-2026-45585, which allows attackers to bypass BitLocker security using a specially crafted USB device. Following the release of exploit code by a hacker named Chaotic Eclipse, Microsoft has issued urgent mitigation advice. Cybersecurity expert Neena Sharma recommends treating this as an active threat and suggests implementing compensating controls, such as restricting USB boot access, until a patch is available. Microsoft has provided guidance for users to protect their systems, including the recommendation to add a PIN to BitLocker protection to reduce the risk of exploitation. Detailed instructions for adding a PIN are included in the advisory. YellowKey has not yet been exploited in the wild but requires physical access to the device.

Winsage

January 10, 2026

Microsoft Ends Support for Windows 11, Office 2021 in 2026: Upgrade Now

Microsoft will conclude support for several key products on October 14, 2026, including Windows 11 version 24H2 and Office 2021. This end-of-support wave also affects various Azure services, Exchange Server versions, and certain .NET frameworks. Organizations must evaluate migration costs and risks associated with operating unsupported products, as the lack of updates could lead to security vulnerabilities. Extended Security Updates (ESUs) will be available for select products but at a premium cost. Migration challenges include potential hardware incompatibilities and the need for custom solutions for legacy applications. Proactive planning, inventory assessments, and prioritizing critical systems for migration are recommended strategies. The transition aligns with Microsoft's vision of promoting cloud-based and AI-enhanced technologies. Economic implications include increased IT spending, particularly affecting small and medium enterprises.

Winsage

November 3, 2025

Microsoft Sounds Windows 11 And Server Update Failure Alarm

Microsoft has confirmed that users of Windows 11 and Windows Server are experiencing authentication failures due to updates released on or after August 29. This issue, detailed in Microsoft Support posting KB5070568, is linked to duplicate Security IDs (SIDs) on devices, affecting Windows 11 versions 24H2 and 25H2, as well as Windows Server 2025. The problem arises from new security protections that enforce checks on SIDs, which are necessary to maintain user account integrity and prevent unauthorized access. Duplicate SIDs typically result from unsupported cloning or duplication of a Windows installation without using the Sysprep tool. The recent update mandates SID uniqueness, blocking authentication handshakes between devices with duplicate SIDs. To resolve this, users must rebuild their devices using supported methods for cloning or duplicating a Windows installation to ensure unique SIDs.

Winsage

October 17, 2025

For October’s Patch Tuesday, a scary number of fixes

Microsoft has released an important update for SQL Server, designated as CVE-2025-59250, which addresses an issue with JDBC integration and requires a server reboot. Additionally, three updates for Microsoft Exchange Server have been issued: CVE-2025-53782, CVE-2025-59249, and CVE-2025-59248. Microsoft has also introduced six important updates for .NET and Visual Studio, including an update for Git (CVE-2025-54132) related to a bug in the Mermaid Diagram tool. Furthermore, Microsoft has released seven updates from various third-party vendors, including CERT/CC, Mitre, and GitHub, with Mitre and AMD advocating for CVE entries on behalf of open-source organizations to expedite patching.