NewApp Digest
search bot

Exploited Vulnerabilities

Windows info-disclosure 0-day bug gets a fix as CISA sounds alarm
Winsage
January 15, 2026

Windows info-disclosure 0-day bug gets a fix as CISA sounds alarm

Microsoft and the U.S. government have issued a warning about a vulnerability in Windows, designated CVE-2026-20805, which is currently being exploited. This flaw allows an authorized attacker to leak a memory address from a remote ALPC port, potentially leading to arbitrary code execution. It has a medium severity rating of 5.5 on the CVSS scale. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and requires federal agencies to implement a patch by February 3. Additionally, two other vulnerabilities were acknowledged: CVE-2026-21265, a secure boot certificate expiration bypass with a CVSS rating of 6.4, and CVE-2023-31096, an elevation of privilege flaw affecting third-party Agere Modem drivers, rated at 7.8. Two more vulnerabilities, CVE-2026-20952 (CVSS 7.7) and CVE-2026-20953 (CVSS 7.4), are use-after-free flaws in Office that could allow unauthorized code execution.
U.S. CISA adds a flaw in Microsoft Windows to its Known Exploited Vulnerabilities catalog
Winsage
January 14, 2026

U.S. CISA adds a flaw in Microsoft Windows to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft Windows vulnerability, CVE-2026-20805, to its Known Exploited Vulnerabilities (KEV) catalog, with a CVSS score of 8.7. This vulnerability, part of the January 2026 Patch Tuesday updates, affects the Windows Desktop Window Manager and allows attackers to leak memory information, potentially aiding in further exploits. Federal Civilian Executive Branch agencies must address this vulnerability by February 3, 2026, as mandated by Binding Operational Directive 22-01.
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
Winsage
January 14, 2026

Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited

On Tuesday, Microsoft released its first security update for 2026, addressing 114 vulnerabilities, including eight classified as Critical and 106 as Important. The vulnerabilities include 58 related to privilege escalation, 22 concerning information disclosure, 21 linked to remote code execution, and five categorized as spoofing flaws. A notable vulnerability, CVE-2026-20805, involves information disclosure within the Desktop Window Manager (DWM) and has a CVSS score of 5.5. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog, requiring federal agencies to implement fixes by February 3, 2026. Additionally, Microsoft announced the expiration of three Windows Secure Boot certificates issued in 2011, effective June 2026, urging customers to transition to newer certificates to avoid disruptions. The update also removed vulnerable Agere Soft Modem drivers due to a local privilege escalation flaw (CVE-2023-31096) and addressed another critical privilege escalation flaw in Windows Virtualization-Based Security (CVE-2026-20876) with a CVSS score of 6.7. Other vendors, including Adobe, Amazon Web Services, and Cisco, have also released security patches for various vulnerabilities.
Windows RemoteApp problems, ferry malware arrest, Senator’s open-source warning
Winsage
December 20, 2025

Windows RemoteApp problems, ferry malware arrest, Senator’s open-source warning

Microsoft's December 2025 security update disrupts Message Queuing (MSMQ) on older Windows 10 and Server systems. A subsequent November 2025 update causes RemoteApp connection failures on Windows 11 24H2/25H2 and Windows Server 2025 devices, particularly in Azure Virtual Desktop environments, although Windows Home or Pro editions remain unaffected. French authorities arrested two crew members of an Italian ferry for allegedly installing malware that could allow remote control of the vessel; one suspect has been released while the other is in custody. Tom Cotton, Chairman of the Senate Intelligence Committee, has urged action on vulnerabilities in open-source software, citing concerns about foreign adversaries inserting malicious code. A zero-day exploit, CVE-2025-20393, affecting Cisco email security products has been exploited by Chinese hackers since late November. DXS International reported a cybersecurity incident involving unauthorized access to its internal servers, with an investigation ongoing. A report from Resecurity indicates a rise in the criminal use of DIG AI for generating tips for illegal activities. CISA warned of a critical vulnerability in ASUS Live Update software, which has been actively exploited. An automated campaign targeting multiple VPN platforms has been reported, with credential-based attacks observed on Palo Alto Networks GlobalProtect and Cisco SSL VPN.
U.S. CISA adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog
Winsage
December 10, 2025

U.S. CISA adds Microsoft Windows and WinRAR flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog to include two critical vulnerabilities: 1. CVE-2025-6218 (CVSS score of 7.8) - RARLAB WinRAR Path Traversal Vulnerability, which allows attackers to execute arbitrary code by manipulating file paths within a malicious archive or webpage. 2. CVE-2025-62221 (CVSS score of 7.8) - Microsoft Windows Use After Free Vulnerability, which enables an authorized attacker to elevate their privileges locally to SYSTEM. Federal agencies are required to address these vulnerabilities by December 30, 2025, in accordance with Binding Operational Directive (BOD) 22-01.
Windows Server Update Service exploitation ensnares at least 50 victims
Winsage
October 31, 2025

Windows Server Update Service exploitation ensnares at least 50 victims

Over 50 organizations in the United States have been targeted in attacks exploiting a vulnerability in the Windows Server Update Service (WSUS), identified as CVE-2025-59287, related to the deserialization of untrusted data. Despite a security update from Microsoft in mid-October, an emergency out-of-band update was issued due to its inadequacy. Sophos recorded six incidents linked to this exploitation, with indications of broader impacts. The affected sectors include technology, education, manufacturing, and healthcare. The hacker group UNC6512 has been connected to these activities, conducting reconnaissance and exfiltrating sensitive data. Sophos detected malicious activity on October 24, following the release of the out-of-band patch. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and urged security teams to apply necessary patches and check for signs of compromise.
Warnings Mount Over Windows Server Update Services Hacks
Winsage
October 29, 2025

Warnings Mount Over Windows Server Update Services Hacks

Concerns have increased regarding a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, which allows unauthenticated attackers to execute arbitrary code. This vulnerability arises from a legacy serialization mechanism within WSUS, which is no longer actively developed. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating its urgency. Cybersecurity firms have reported active exploitation attempts, with thousands of WSUS instances exposed to the internet. Attacks are primarily reconnaissance activities that could lead to broader network compromises. If an attacker compromises a single server, they could control the entire patch distribution system, enabling internal supply chain attacks and distributing malware disguised as legitimate Microsoft updates. Alerts have been issued by the Canadian Center for Cybersecurity and the Australian Cyber Security Centre regarding this global threat. Microsoft's initial patch on October 15 failed to fully resolve the issue, allowing attackers to exploit the vulnerability quickly. Attack vectors include exploiting the deserialization of AuthorizationCookie objects and unsafe deserialization via the ReportingWebService. The vulnerability is particularly concerning because WSUS is often neglected and should not be exposed to the internet.
Google probes exploitation of critical Windows service CVE
Winsage
October 28, 2025

Google probes exploitation of critical Windows service CVE

The Google Threat Intelligence Group (GTIG) is investigating cyberattacks linked to a hacker exploiting a vulnerability in the Windows Server Update Service (WSUS), specifically CVE-2025-59287. The threat actor, UNC6512, has targeted multiple organizations, gaining access to systems, conducting reconnaissance, and exfiltrating data. Despite a Microsoft patch released earlier, it has been ineffective. Researchers from HawkTrace and Eye Security have identified suspicious activities related to the vulnerability, with Eye Security noting at least two adversaries exploiting it. Palo Alto Networks Unit 42 confirmed the use of malicious PowerShell commands for exploitation. Shadowserver reported around 2,800 instances exposed to this flaw. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and is urging users to implement the patch. CISA has found no evidence of federal agency impacts but encourages reporting of suspicious activities.
Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild
Winsage
October 28, 2025

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild

On October 14, 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-59287, was discovered in Microsoft's Windows Server Update Services (WSUS). The vulnerability allows remote, unauthenticated attackers to execute arbitrary code with system privileges on affected servers. It was initially addressed on October 14, but the patch was insufficient, leading to an urgent out-of-band update on October 23. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 24, indicating its immediate threat. The vulnerability affects Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, specifically on servers with the WSUS role enabled. Attackers are exploiting the vulnerability by targeting publicly exposed WSUS instances on TCP ports 8530 (HTTP) and 8531 (HTTPS). Approximately 5,500 WSUS instances have been identified as exposed to the internet. Microsoft recommends disabling the WSUS Server Role or blocking inbound traffic to the high-risk ports as temporary workarounds for organizations unable to apply the emergency patches immediately.
Search