Search: “Microsoft Windows”

7 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Threat actor 19 Malware 18 Industry 17 AI safety & security 9 Vulnerability 9 Exploit / PoC 8 AI industry 7 Phishing & fraud 7 Advisory 6 Research 4 Tools 4 AI tools & infra 1 AI research 1 Model release 1

SeverityAll critical 4 high 40 medium 28 low 2 info 39

ZDI-26-708: (0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability

ZDI disclosed an unpatched local privilege escalation flaw (CVSS 5.3) in Microsoft Windows HTTP Proxy, requiring prior low-privileged code execution.

ZDI-26-708 details a privilege escalation vulnerability in the Microsoft Windows HTTP Proxy component. A local attacker who can already execute low-privileged code on the target system can escalate privileges. ZDI assigned a CVSS rating of 5.3 and published it as a 0day advisory; no CVE id is listed in the bulletin text.

ZDI Published AdvisoriesSep 16, 05:00 UTC · 1d agoVulnerability 11 sources

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security NewsSep 16, 07:45 UTC · 1d agoVulnerability in the wildCVE-2026-627211

Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections

Microsoft's September 2026 Windows 11 update KB5124008 breaks certificate-based Always On VPN on some enterprise clients, forcing admins to pause rollout.

Microsoft's September 8, 2026 cumulative update KB5124008 for Windows 11 24H2 (build 26100.9445) and 25H2 (build 26200.9445) breaks certificate-based Always On VPN tunnels on some enterprise clients, with connectivity restored after uninstalling the update and rebooting. The issue was first detailed on Microsoft Q&A on September 9 by an administrator using Intune-deployed VPN profiles with RRAS and NPS on Windows Server 2019. The same mandatory Patch Tuesday package fixes two actively exploited zero-days, CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call, so many teams are pausing only VPN cohorts rather than blocking the full rollout.

Cyber Security Newsupdated Sep 15, 10:17 UTC · 2d agofirst Sep 11, 13:11 UTC · 5d agoVulnerability in the wild 9 sources CVE-2026-81963 CVE-2026-858802

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 10h agofirst Sep 16, 20:39 UTC · 14h agoVulnerability 2 sources

Microsoft’s Patching

Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, amid AI-accelerated vulnerability discovery.

Microsoft's September 2026 Patch Tuesday patches a record ~972 vulnerabilities, 112 rated critical, following records of 570 two months ago and ~620 last month. Schneier attributes the surge to AI-powered vulnerability finding, citing an open letter from OpenAI, Anthropic, AWS, Google, Microsoft and roughly 100 organizations warning of an AI-enabled attack tsunami. He predicts AIs will reverse-engineer exploits from patches, weaponizing flaws immediately upon release and shrinking the patch window to 'immediately.'

Schneier on SecuritySep 14, 11:03 UTC · 2d agoVulnerability1

Remote Desktop Services Failures on Windows Servers Following September Update

September 2026 Patch Tuesday updates cause Windows Server 2019/2022/2025 RDS sessions to freeze, forcing administrators to roll back.

Cumulative updates KB5122876 (Windows Server 2019), KB5122882 (2022), and KB5122871 (2025) trigger Remote Desktop Services freezes hours after boot, with RDP connections hanging at 'Connecting…' and Event ID 20498 logged. Administrators trace the fault to an apparent deadlock in RDPSERVERBASE!WDLIB_Close during session teardown; only hard resets restore service and the issue recurs. The same September release patched roughly 973 vulnerabilities, including two actively exploited zero-days (CVE-2026-81963, CVE-2026-85880, both in CISA's KEV) and a critical RDS RCE, CVE-2026-69525 (CVSS 9.8). Workarounds include DISM-based removal of the update or an unofficial FeatureManagement registry key disabling the suspected audio-redirection code path; Microsoft has not yet confirmed the bug.

Cyber Security NewsSep 11, 04:46 UTC · 6d agoVulnerability in the wild 2 sources CVE-2026-81963 CVE-2026-85880 CVE-2026-69525+1 CVEs1

VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks

AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.

CERT/CC issued VU#687587 for CVE-2026-12780, an incorrect permission assignment (CWE-732) in the amwrtdrv.sys kernel driver shipped with AOMEI Backupper 8.4.0. The driver exposes a world-accessible device object without a security descriptor, allowing any unprivileged user to write arbitrary physical disk sectors; with Secure Boot disabled, an attacker can modify the GPT and inject a UEFI payload that executes before the OS loads, bypassing HVCI, EDR, Windows Defender and Hyper-V isolation. On TPM-only BitLocker configurations the attack can capture Volume Master Key material during pre-boot. AOMEI has shipped patches; users who cannot update should uninstall the software or disable the amwrtdrv.sys service, and enabling Secure Boot adds defense in depth.

CERT/CC Vulnerability NotesSep 10, 17:46 UTC · 6d agoVulnerability CVE-2026-127801