Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.
ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.
The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
Arctic Wolf disclosed a widespread data theft and extortion cluster, PREY-0058, which overlaps with Mandiant's UNC6671 and possibly the Pink/Cinder extortion groups. Attackers impersonate IT help desk staff by phone, direct executives to authentication-themed lure domains, and run adversary-in-the-middle Microsoft 365 logins to harvest credentials, MFA approvals, and session tokens replayed via residential proxies such as NodeMaven. After access, they run discovery in SharePoint and Entra ID, then bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box before sending extortion demands. Targets are primarily US construction, healthcare, real estate, finance, and professional services organizations.
CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.
CISA advisory AA26-237A, 'A Tale of Two SOCs,' describes two simultaneous red team assessments of a Government Services organization and a Water and Wastewater Systems organization, both compromised to the domain level. Organization A never detected the intrusion, enabled by default credentials, a misconfigured AD CS template (ESC1), cleartext credentials, non-expiring static AWS keys, and over-permissioned Entra ID applications. Organization B detected and isolated phishing within 2-20 minutes, though the red team still reached krbtgt via DCSync from cleartext SCCM credentials. CISA attributes the outcome gap to people and processes rather than the security tools themselves.
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.
Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.
A seller offers 1.7 million McDonald's employee records allegedly taken from its Azure tenant via compromised credentials; an 8,000-row sample verifies as genuine.
A forum seller named TheHatman posted an 8,000-row sample of McDonald's employee directory data, claiming a 1.7 million-record haul pulled directly from the company's Azure tenant using compromised credentials. Ransomnews analysis found authentic Entra ID export artifacts, including genuine domains, tenant-internal addresses, encoding errors, and truncated HR fields, but could not verify the data's age or the 1.7 million figure. The same seller listed nine datasets in 16 days covering about 3.6 million records across McDonald's, Vodafone, Gap, hotels, and IT outsourcers, suggesting infostealer-driven credential resale. No passwords or hashes appear in the sample, so the primary risk is social engineering.
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.
Local Privilege Escalation via Link Following in Windows Update Stack
CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.
· Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 · Microsoft Windows Server 2025 KEVmass
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.
· Microsoft Windows 10 1607, 1809, 21H2, 22H2 · Microsoft Windows Server 2012, 2016, 2019, 2022 KEVmass
Missing Authorization in Microsoft Entra ID Enables Privilege Escalation
CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.
Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation
CVE-2026-62916 is an authentication bypass (CWE-288) in Microsoft Entra ID, Microsoft's cloud identity and access management service, in which an alternate path or channel allows authentication checks to be circumvented. Per the CVSS vector, it is exploitable remotely over a network with no privileges and no user interaction required, by authenticating via an alternate path instead of the standard sign-in flow. A successful unauthenticated attacker gains the ability to elevate privileges, with high impact on confidentiality, integrity, and availability reflected in the 9.8 critical score. The affected population includes organizations relying on Entra ID, which is the default identity platform for Microsoft 365, Azure, and hybrid deployments; the available data does not specify affected versions or the specific sub-component involved. There is no public proof-of-concept, no confirmed in-the-wild exploitation, and the CVE is not in CISA's KEV; EPSS assigns a 0.6% probability of exploitation within 30 days.
CVE-2026-65772 is a deserialization of untrusted data flaw (CWE-502) in Microsoft Dynamics 365 that allows an authorized (authenticated, low-privilege) attacker to execute code over the network. It is triggered when the application processes attacker-controlled serialized data, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network exploitation with low attack complexity, low required privileges, and no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively amounting to remote code execution within the affected Dynamics 365 environment. Any organization running the affected Microsoft Dynamics 365 deployments is in scope, with authenticated users or compromised low-privileged accounts able to trigger the flaw; the available data does not specify which Dynamics 365 editions or version ranges are affected. As of the September 2026 Patch Tuesday coverage, there is no evidence of in-the-wild exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns roughly a 0.9% probability of exploitation within 30 days (58th percentile).
Heap-Based Buffer Overflow in Microsoft Excel and Office Allows Local Code Execution
CVE-2026-81948 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel that Microsoft addressed in its September 2026 Patch Tuesday release, allowing an unauthorized attacker to execute code locally. Given the local attack vector and user-interaction requirement (AV:L, UI:R), exploitation most likely requires a user to open a specially crafted spreadsheet in an affected version of Excel. A successful attack would run attacker-controlled code with the privileges of the signed-in user, with high impact on the confidentiality, integrity, and availability of the system. Users of Excel within Microsoft 365 / Microsoft 365 Apps and Office 2016, 2019, 2021, and 2024 are affected. As of this advisory there is no known exploitation in the wild, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation in the next 30 days.
· Microsoft Excel (affected component across the listed Office releases) · Microsoft 365mass
Heap-based Buffer Overflow in Microsoft Excel Enables Local Code Execution
CVE-2026-81951 is a heap-based buffer overflow (CWE-122) in Microsoft Excel, the spreadsheet component of Microsoft Office and Microsoft 365. Per the CVSS vector (AV:L with UI:R and no privileges required), exploitation requires user interaction, most plausibly a user opening a crafted spreadsheet, rather than any network-reachable service. Successful exploitation lets an unauthorized attacker execute arbitrary code locally, with the CVSS scoring high impact on confidentiality, integrity, and availability. All supported Excel-bearing releases are affected: Microsoft 365 Apps/Microsoft 365, Office 2016, Office 2019, Office 2021, and Office 2024. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days, indicating no known in-the-wild exploitation as of the September 2026 Patch Tuesday that shipped the fix.
Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution
CVE-2026-58599 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Codecs Library, patched by Microsoft as part of the September 2026 Patch Tuesday. The CVSS vector (AV:L, UI:R, no privileges required) indicates the flaw is triggered locally when the codecs library processes specially crafted content, requiring user interaction such as opening a malicious media or image file. A successful attacker can execute arbitrary code in the context of the local user with no prior privileges, with high impact on confidentiality, integrity, and availability. Any Windows system containing the affected Windows Codecs Library is exposed, though the source data does not enumerate specific Windows versions or builds. Exploitation is currently quiet: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (25th percentile).
· Microsoft Windows (Windows Codecs Library component)mass
Heap Buffer Overflow in Microsoft Excel Allows Local Code Execution (CVE-2026-81959)
CVE-2026-81959 is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel, with an associated integer overflow/wraparound (CWE-190) that Microsoft notes as part of the flaw. Because the attack vector is local and requires user interaction, exploitation requires a user to open a specially crafted spreadsheet file in an affected Excel or Office installation, for example one delivered via email or downloaded from an untrusted source. Successful exploitation allows an unauthorized attacker to execute arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability on the victim machine. Anyone running Excel in Microsoft 365 Apps or perpetual Office 2016, 2019, 2021, or 2024 is affected. The flaw was addressed in Microsoft's September 2026 Patch Tuesday (a release covering 974 vulnerabilities); it is not in CISA KEV, no public proof-of-concept is known, and EPSS puts 30-day exploitation probability at just 0.4%, so no confirmed in-the-wild exploitation is known.
Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio
CVE-2026-62906 is an improper neutralization of special elements in data query logic (CWE-943, an SQL-injection-style flaw) in Microsoft Discovery Studio that allows an unauthorized attacker to disclose information over a network. It is remotely exploitable without authentication (AV:N/PR:N) but requires user interaction (UI:R), meaning a user must perform some action, such as clicking a crafted link or submitting crafted input, for the attack to succeed. Successful exploitation has a high impact on confidentiality, potentially exposing sensitive data, while integrity and availability are unaffected. Any organization running Microsoft Discovery Studio is potentially affected, and Microsoft addressed the issue as part of the September 2026 Patch Tuesday security updates. There is currently no known public proof-of-concept, no inclusion in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days, so no active exploitation is known at this time.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.