60
Search: “Microsoft Execution Containers”
1,161 stories
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
60
60
60
60
Microsoft Patch Tuesday for July 2022 — Snort rules and prominent vulnerabilities
60
60
Six critical vulnerabilities included in August’s Microsoft security update
60
60
60
60
Microsoft patches 12 critical vulnerabilities, nine of which are in Layer 2 Tunneling Protocol
60
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.
CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).
78
60
60
60
60
Vulnerability landscape analysis for Q4 2024
60
Microsoft Patch Tuesday for April 2021 — Snort rules and prominent vulnerabilities
60
CISA added 7 new flaws to its Known Exploited Vulnerabilities Catalog
60
Update Microsoft Windows Systems to Patch 99 New Security Flaws
60
60
4 New BlueKeep-like 'Wormable' Windows Remote Desktop Flaws Discovered
60
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
63
Microsoft discloses 5 critical vulnerabilities in June's Patch Tuesday, no zero
60
Microsoft September 2020 Patch Tuesday addresses 129 flaws
60
60
Microsoft Patch Tuesday for Jan. 2022 — Snort rules and prominent vulnerabilities
60
Microsoft Patch Tuesday for April 2025 — Snort rules and prominent vulnerabilities
60
60
Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.
Microsoft tracked a million-message AI-assisted BEC campaign impersonating executives with fake ServiceNow invoices to steal ~$50,000 ACH payments.
Microsoft detected over one million messages in a BEC campaign running August 3-5, using AI-assisted phishing templates, executive impersonation, and fabricated ServiceNow subscription invoices to trick finance teams into authorizing fraudulent ACH payments of roughly $50,000. The US received 87.7% of volume. Attackers used lookalike domains like service-nowinc[.]com registered just days before delivery, with no compromise of ServiceNow itself. Telltale signs included verbose HTML comments, uniform formatting, and inconsistent forwarded-message headers.
68
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.
78
60
Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway)
60
ToolShell: a story of five vulnerabilities in Microsoft SharePoint
60
November Patch Tuesday release contains three critical remote code execution vulnerabilities
60
Microsoft patches three exploited zero-days (CVE-2023-21715, CVE-2023-23376, CVE-2023-21823)
60
60
Patch Tuesday fixes four Microsoft zero
60
60