Exploited Vulnerabilities Archives

Winsage

August 18, 2026

CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed a privilege escalation vulnerability in the Windows Task Host, designated as CVE-2025-60710, which is being exploited by ransomware groups. Microsoft released a patch for this flaw on November 11, 2025, and CISA added it to its Known Exploited Vulnerabilities catalog on April 13. The vulnerability allows scheduled tasks to operate at the highest privilege level, enabling attackers to delete files and potentially gain full control over a machine. This access can lead to the extraction of credentials, manipulation of endpoint protection, and lateral movement across networks, culminating in widespread ransomware deployment. Security experts emphasize the critical nature of this vulnerability and urge organizations to address it promptly, as it poses significant risks to systems running Windows 11 and Server 2025.

Winsage

August 18, 2026

CISA: Windows Task Host flaw now exploited by ransomware gangs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs are exploiting a significant vulnerability in the Windows Task Host system, tracked as CVE-2025-60710. This high-severity flaw, affecting Windows 11 and Windows Server 2025, allows local attackers with basic user permissions to escalate their privileges to SYSTEM level. Microsoft patched this vulnerability in November 2025, but it poses a threat to unpatched devices. CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and provided Federal Civilian Executive Branch agencies with a two-week window to secure their systems. CISA warns that such vulnerabilities are frequent attack vectors for malicious actors and urges organizations to apply mitigations or discontinue the use of affected products. Additionally, CISA noted that ransomware groups are also exploiting a Microsoft SharePoint remote code execution vulnerability (CVE-2026-45659), confirmed to be actively exploited in early July. Since November 2021, CISA has identified 383 actively exploited vulnerabilities across various Microsoft products, with 112 being used in ransomware attacks.

Winsage

August 16, 2026

LeakWatch CW 33/2026: Windows Zero-Day, AMD, Intel and Malware

- The August Patch Tuesday release included 421 vulnerabilities, with 236 affecting Windows, highlighting CVE-2026-68820, a critical use-after-free vulnerability that allows privilege escalation to SYSTEM level without user interaction. - CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation. - AMD's Ryzen Master software has vulnerabilities, including CVE-2025-54512 (DLL hijacking) and CVE-2026-0465 (use-after-free), which could allow code execution with elevated privileges. - AMD's advisory on CVE-2026-6726 and CVE-2026-6727 indicates vulnerabilities in the TPM 2.0 reference code affecting Ryzen platforms, leading to potential information disclosure. - Intel's advisories included updates for microcode, Wi-Fi software, and NPU drivers, with CVE-2026-20760 addressing privilege escalation risks. - Google’s Chrome update on August 11 fixed five high-severity vulnerabilities, including use-after-free flaws. - Gunra malware has evolved into a ransomware-as-a-service model using a double-extortion strategy. - WindRelay malware combines SpyNote RAT with an NFC relay component, allowing attackers to relay NFC communication between a victim's bank card and a remote device. - The findings emphasize the need to view vulnerabilities as part of potential attack chains, highlighting the complexity of modern cybersecurity threats.

Winsage

July 29, 2026

Missed Windows 11 Secure Boot? Don’t panic, Microsoft is still pushing it in the coming months

Microsoft reassured Windows 11 and Windows 10 users that their PCs will continue to boot normally and receive updates even if they have not yet received the new Secure Boot 2023 certificates. The rollout of these certificates is expected to continue over the upcoming months. The initial Secure Boot certificate expired on June 24, 2026, and Microsoft has been replacing older 2011 certificates since 2024. The latest update, KB5101650, transitioned Windows 11 to OS builds 26200.8875 and 26100.8875 for versions 25H2 and 24H2, respectively. The 2023 certificates replace older certificates with modern cryptographic standards, allowing Microsoft to deliver DBX revocation updates without interruption. Devices using the 2011 KEK can only receive DBX updates signed with that key, which is no longer valid after June 24. Microsoft has been rolling out the 2023 certificates for the past two years, and many devices remained in a yellow or red status by the June deadline. To check Secure Boot status, users can navigate to Windows Security > Device Security. A green checkmark indicates successful application of the certificates, while yellow and red alerts indicate compatibility issues or firmware incompatibility. PCs that are older or operating in Legacy BIOS mode will not receive the updates. Windows 10 also receives Secure Boot updates, but enrollment in Extended Security Updates (ESU) is required.

Winsage

July 23, 2026

Windows 10 has almost three times as many active vulnerabilities as Windows 11, according to researchers

Windows 11 is installed on 78.8% of Windows computers, while 16.9% of users remain on Windows 10. Microsoft ended support for Windows 10 in October 2025, with an extension until 2027. Windows 10 has 1,903 active Common Vulnerabilities and Exposures (CVEs), 2.9 times more than Windows 11, which has 652 CVEs. Of the active CVEs on Windows 10, 66.6% are classified as high or critical risk, with 2.4% actively exploited. Small businesses show the most significant lag in upgrading, with 21.4% still using Windows 10, while two-thirds of large enterprises have moved to Windows 11. The cost of upgrading is a primary barrier for smaller companies.

Winsage

July 16, 2026

Windows Netlogon Flaw CVE-2026-41089: CVSS 9.8 [2026]

CVE-2026-41089 is a critical vulnerability in the Windows Netlogon service, rated 9.8 on the CVSS scale, allowing unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on domain controllers. It affects all supported versions of Windows Server configured as domain controllers, from Windows Server 2012 R2 to the latest release. Microsoft addressed this vulnerability on May 12, 2026, during a broader update that included 138 fixes, but it went largely unnoticed until early June when active exploitation was confirmed. The vulnerability is characterized as a stack-based buffer overflow and is considered "wormable" due to its ability to self-propagate across systems without user intervention. Organizations are advised to patch all domain controllers and audit network access to mitigate exposure.

Winsage

July 15, 2026

Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday

Security researcher Chaotic Eclipse has released a proof-of-concept exploit called LegacyHive, which targets a vulnerability in the Windows User Profile Service. The exploit requires standard user credentials and a third username, potentially an administrator account. It can mount the target user hive in the current user classes root and is designed to reduce the risk of public exploitation. The exploit works across all supported desktop and server versions of Windows, including those updated with the July 2026 Patch Tuesday release. Microsoft is investigating the findings related to LegacyHive. Microsoft has patched 622 vulnerabilities, including two privilege escalation flaws in SharePoint Server (CVE-2026-56164, CVSS score: 5.3) and Active Directory Federation Services (CVE-2026-56155, CVSS score: 7.8), which are actively exploited threats. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included these vulnerabilities in its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to implement fixes by specified deadlines. CISA has also noted active exploitation of several SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164, which allow unauthorized access to vulnerable instances. CVE-2026-56164 enables attackers to send crafted network requests to access functions that should require authorization, leading to privilege escalation without prior authentication. Additionally, CVE-2026-55040 (CVSS score: 9.1) allows remote unauthenticated attackers to bypass authentication on a vulnerable SharePoint server, enabling unauthorized operations.

Tech Optimizer

June 23, 2026

Active Exploitation of Critical CVE-2026-20253 in Splunk Enterprise: Unauthenticated RCE via PostgreSQL Sidecar Service

A critical security vulnerability, SVD-2026-0603 (CVE-2026-20253), has been identified in Splunk Enterprise versions 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3. This flaw allows unauthenticated, remote attackers to create or truncate arbitrary files on the host system by exploiting the PostgreSQL Sidecar Service endpoints. The vulnerability is actively exploited, with public proof-of-concept code available, and has been added to the CISA Known Exploited Vulnerabilities (KEV) list. Successful exploitation can lead to full remote code execution (RCE) as the Splunk user. The vulnerability arises from inadequate authentication controls on the PostgreSQL Sidecar Service endpoints, specifically /v1/postgres/recovery/backup and /v1/postgres/recovery/restore, which are accessible without authentication. It is classified under CWE-306: Missing Authentication for Critical Function and has a CVSS v3.1 base score of 9.8 (Critical). Attackers can exploit the vulnerability by sending crafted HTTP POST requests to the exposed endpoints, allowing them to create or truncate files and potentially execute malicious scripts. Indicators of compromise include unexpected files in directories such as /tmp/ or /opt/splunk/var/run/supervisor/pkg-run/, modified Splunk Python scripts, and unusual outbound connections from Splunk to unknown PostgreSQL servers. The vulnerability aligns with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter). Active exploitation of CVE-2026-20253 has been confirmed, and it is likely that both opportunistic cybercriminals and sophisticated threat actors will use this exploit. The affected versions of Splunk Enterprise are 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, with the issue resolved in versions 10.2.4 and 10.0.7. Organizations are advised to upgrade to fixed versions or disable the PostgreSQL Sidecar Service as a mitigation strategy.

Winsage

May 28, 2026

Your Windows PC has a security deadline in June 2026

A Secure Boot certificate refresh is being deployed across supported Windows devices via Windows Update. The Secure Boot certificates from 2011 will begin to expire in June 2026, prompting Microsoft to introduce new 2023-dated certificates to maintain security. Most users will require minimal action if their PCs are updated, but older devices may face challenges. The current certificates include: - Microsoft Corporation KEK CA 2011: expires June 24, 2026 - Microsoft UEFI CA 2011: expires June 27, 2026 - Microsoft Windows Production PCA 2011: expires October 19, 2026 The new certificates will remain valid until 2038, with plans for post-quantum cryptography around 2030. While PCs using the 2011 certificates will continue to function, they will lose access to new security protections, making them vulnerable to emerging threats. A notable example of such a threat is the BlackLotus bootkit, which exploited vulnerabilities to bypass Secure Boot. Microsoft's rollout strategy involves a staged update process that typically takes around 48 hours and may require restarts. Users are advised to keep Windows updated and check their Secure Boot status. Known issues may arise for older PCs, systems that bypassed Windows 11 requirements, Legacy BIOS systems, and custom firmware configurations. IT teams managing devices should inventory their systems, monitor specific event IDs, test updates, and document devices that cannot be updated.

Tech Optimizer

May 22, 2026

Microsoft confirms two major Defender security issues — so update now or face possible attack

Microsoft has addressed two critical zero-day vulnerabilities in its Defender antivirus software: CVE-2026-41091 (privilege escalation) and CVE-2026-45498 (denial of service). The patches were delivered through Malware Protection Engine version 1.1.26040.8 and Antimalware Platform version 4.18.26040.7. Users are advised to verify their software versions to ensure they have the latest updates. Both vulnerabilities have been included in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, requiring federal agencies to patch them or stop using the affected software by June 3.