NewApp Digest
search bot

Windows vulnerabilities

Microsoft's July patches fix over 600 flaws, shattering last month's record
Winsage
July 16, 2026

Microsoft’s July patches fix over 600 flaws, shattering last month’s record

Microsoft has released its July 2026 Patch Tuesday updates, addressing 570 new security vulnerabilities, bringing the total for the month to over 620. The cumulative count of vulnerabilities patched this year has reached 1,380, exceeding the total of 1,250 for the entire year of 2020. Over 400 vulnerabilities are related to various versions of Windows, and the Windows 10 Extended Security Update program has been extended until October 12, 2027. Notable vulnerabilities include CVE-2026-56155 in Active Directory Federation Services, which allows attackers to gain administrator rights, and several critical Remote Code Execution vulnerabilities, including CVE-2026-57092 in Hyper-V and CVE-2026-56190 in Remote Desktop Protocol. Microsoft has also patched 97 vulnerabilities in Office products, with 17 classified as critical RCE vulnerabilities, and four vulnerabilities in Exchange Server, including CVE-2026-55008. The latest Microsoft Edge update addresses 27 vulnerabilities related to Chromium, and a vulnerability in Minecraft Bedrock servers has been patched.
Microsoft Details How It’s Using AI to Improve Windows Security
Winsage
July 9, 2026

Microsoft Details How It’s Using AI to Improve Windows Security

Microsoft has reaffirmed its commitment to security, focusing on enhancing protection for Windows users. The company is utilizing a multi-model agentic scanning harness (MDASH) that incorporates various AI models to identify Windows vulnerabilities earlier in the development process. This proactive approach allows security experts to detect potential issues before public releases. Microsoft is also investing in technologies that use AI to streamline the development of fixes while maintaining human oversight during code reviews. The company acknowledges the dual nature of AI in security, as it accelerates both the identification of vulnerabilities and the potential for exploitation. Microsoft aims to strengthen its systems to find vulnerabilities earlier and deliver timely security patches to customers.
Microsoft's bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits
Winsage
June 12, 2026

Microsoft’s bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits

Nightmare-Eclipse, also known as Chaotic-Eclipse, has introduced two new exploits: RoguePlanet and GreatXML. RoguePlanet exploits a vulnerability in Windows Defender, allowing attackers to gain SYSTEM user access privileges by tricking a user into executing a script. This access enables attackers to execute commands beyond standard Administrator capabilities, siphon sensitive data, and install malware. GreatXML provides a method for bypassing BitLocker encryption by creating a specially crafted "unattend.xml" file and a "Recovery" directory on the Windows recovery partition. Microsoft has shifted its stance from threatening legal action against Eclipse and is now monitoring the situation, while Eclipse has postponed a planned mass disclosure of zero-day Windows vulnerabilities initially set for July 14 due to delays in developing RoguePlanet.
Microsoft patches a record 206 flaws—and one is already being exploited
Winsage
June 11, 2026

Microsoft patches a record 206 flaws—and one is already being exploited

Microsoft patched 206 vulnerabilities during June's Patch Tuesday, surpassing the previous record of 175 vulnerabilities patched in October 2025. Among the patched vulnerabilities, 118 are related to different versions of Windows, including Windows 10, Windows 11, and Windows Server. One critical vulnerability, CVE-2026-41091, in Microsoft Defender is actively being exploited, prompting an update to the Malware Protection Engine. Microsoft also addressed ten vulnerabilities in the Security Feature Bypass category due to the expiration of old Secure Boot certificates. Of the 118 Windows vulnerabilities, 19 are classified as critical Remote Code Execution (RCE) vulnerabilities, including CVE-2026-47288 and CVE-2026-47291. In Microsoft Office, 54 vulnerabilities were patched, including 25 RCE vulnerabilities, with nine classified as critical. Microsoft patched eight vulnerabilities in Exchange Server, including CVE-2026-45583, which can be exploited in a man-in-the-middle scenario. Additionally, the update for Edge addressed 74 Chromium vulnerabilities, including a zero-day vulnerability (CVE-2026-11645).
Microsoft pits more than 100 AI agents against each other to find Windows vulnerabilities
Winsage
May 14, 2026

Microsoft pits more than 100 AI agents against each other to find Windows vulnerabilities

Microsoft has introduced MDASH (Multi-Model Agentic Scanning Harness), a security solution that uses over 100 specialized AI agents to identify software vulnerabilities. On May 12, 2026, MDASH identified 16 new vulnerabilities (CVEs) in the Windows networking and authentication stack, four of which were critical, including remote code execution vulnerabilities in tcpip.sys, ikeext.dll, netlogon.dll, and dnsapi.dll. Ten of these vulnerabilities can be accessed over the network without authentication. MDASH operates through a four-stage pipeline: analyzing source code, scrutinizing for suspicious elements, debating the exploitability of issues, and attempting to exploit vulnerabilities. The system is model-agnostic and allows integration of new models and domain-specific knowledge. MDASH scored 88.45 percent on the CyberGym benchmark, ranking first among competitors, although the comparison may not be entirely fair as it contrasts a comprehensive framework with individual models. The models used to achieve this score are not specified. MDASH is supported by Microsoft's Autonomous Code Security Team and is currently in a limited private preview for select customers.
Windows Autopatch Adds CVE Reporting to Boost Security Visibility
Winsage
December 8, 2025

Windows Autopatch Adds CVE Reporting to Boost Security Visibility

Microsoft has introduced a Common Vulnerabilities and Exposures (CVE) reporting capability within Windows Autopatch to improve security for IT teams. This tool provides an overview of Windows vulnerabilities addressed in recent updates, enabling device-specific tracking. Key features of the CVE report include a list of CVEs addressed in the past 90 days, tracking of patch compliance at the device level, links to Knowledge Base articles, filtering options, and near real-time updates. Administrators can access the CVEs report by navigating to the Microsoft Intune admin center and selecting the appropriate reports. The report includes CVE identifiers, severity scores, exploitation status, and details on devices needing updates. Organizations can enhance their response to vulnerabilities by utilizing various strategies, such as the Windows Autopatch update readiness feature and targeted fixes with the Security Copilot Vulnerability Remediation Agent.
silver Android smartphone
Winsage
November 1, 2025

Two Windows vulnerabilities, one a 0-day, are under active exploitation

Two significant vulnerabilities in Windows have been identified: one is a zero-day vulnerability, undetected until March 2023, linked to 11 advanced persistent threat (APT) groups, and the other is a critical flaw that Microsoft has struggled to address. The zero-day vulnerability, labeled ZDI-CAN-25373 and later updated to CVE-2025-9491, originates from a flaw in the Windows Shortcut binary format and has been exploited in attacks across nearly 60 countries, with the U.S., Canada, Russia, and Korea being the most targeted. Microsoft has not released a patch for this vulnerability after seven months. A China-aligned threat group, UNC-6384, has been exploiting CVE-2025-9491 to target various European nations, using a remote access trojan called PlugX, which encrypts the binary file with RC4 until the final stage of the attack. Arctic Wolf noted that the coordinated targeting suggests a large-scale intelligence collection operation or multiple operational teams with shared tools.
Microsoft fixed 100+ security flaws in Windows and Office this month
Winsage
August 14, 2025

Microsoft fixed 100+ security flaws in Windows and Office this month

Microsoft has addressed 67 vulnerabilities in its supported Windows versions, including Windows 10, Windows 11, and Windows Server. Users on Windows 7 and Windows 8.1 have not received updates for some time. Upgrading to Windows 11 24H2 is recommended for continued protection. Two critical remote code execution (RCE) vulnerabilities are CVE-2025-53766, affecting the Graphics Device Interface API, and CVE-2025-50165, impacting the Windows Graphics Component. Both can be exploited by visiting a specially crafted website. Three critical vulnerabilities in Hyper-V include CVE-2025-48807, which allows code execution from a guest system to the host; CVE-2025-53781, which poses a data leak risk; and CVE-2025-49707, a spoofing vulnerability. Additionally, 12 vulnerabilities in the Routing and Remote Access Service (RRAS) have been addressed, with half classified as RCE vulnerabilities and the other half as data leaks. CVE-2025-53779, affecting Kerberos for Windows Server 2025, could allow an attacker to gain administrator rights under specific conditions, but is classified as medium risk.
New 'Win-DoS' Zero-Click Vulnerabilities Turns Windows Servers/Endpoints, Domain Controllers Into DDoS Botnet
Winsage
August 11, 2025

New ‘Win-DoS’ Zero-Click Vulnerabilities Turns Windows Servers/Endpoints, Domain Controllers Into DDoS Botnet

Researchers Yair and Shahak Morag from SafeBreach Labs introduced a new category of denial-of-service (DoS) attacks called the “Win-DoS Epidemic” at DEF CON 33. They identified four new vulnerabilities in Windows DoS and one zero-click distributed denial-of-service (DDoS) flaw, classified as “uncontrolled resource consumption.” The vulnerabilities include: - CVE-2025-26673 (CVSS 7.5): High-severity DoS vulnerability in Windows LDAP. - CVE-2025-32724 (CVSS 7.5): High-severity DoS vulnerability in Windows LSASS. - CVE-2025-49716 (CVSS 7.5): High-severity DoS vulnerability in Windows Netlogon. - CVE-2025-49722 (CVSS 5.7): Medium-severity DoS vulnerability in Windows Print Spooler, requiring an authenticated attacker on an adjacent network. These vulnerabilities can incapacitate Windows endpoints or servers, including Domain Controllers (DCs), potentially allowing for the creation of a DDoS botnet. The researchers also discovered a DDoS technique called Win-DDoS that exploits a flaw in the Windows LDAP client’s referral process, enabling attackers to redirect DCs to a victim server for continuous redirection. This method can leverage public DCs globally, creating a large, untraceable DDoS botnet without specialized infrastructure. Additionally, the researchers examined the Remote Procedure Call (RPC) protocol and found three new zero-click, unauthenticated DoS vulnerabilities that can crash any Windows system. They also identified another DoS flaw exploitable by any authenticated user on the network. The researchers released tools named “Win-DoS Epidemic” to exploit these vulnerabilities, highlighting the need for organizations to reassess their security measures regarding internal systems and services like DCs.
Search