Tag Archives: Exchange

August Microsoft Patch Tuesday

Leave a reply

August Microsoft Patch Tuesday

August Microsoft Patch Tuesday. A total of 401 vulnerabilities were addressed - 170 fewer than in July. One of the vulnerabilities is known to be actively exploited in the wild:

🔻 EoP - Windows Ancillary Function Driver for WinSock (CVE-2026-68820). A local attacker can exploit this vulnerability to gain SYSTEM-level privileges. There is a contradiction in Microsoft's description: the Exploit Code Maturity in CVSS is marked as "Unproven", while at the same time Microsoft states that the vulnerability is being exploited in the wild. 🤷‍♂️

Public exploits are available for two other vulnerabilities:

🔸 EoP - Windows User Profile Service (CVE-2026-62832). This vulnerability allows an authenticated attacker to elevate privileges to ADMINISTRATOR level. Rapid7 believes this vulnerability is related to the LegacyHive exploit, which was published on July 14.

🔸 EoP - Windows Kernel (CVE-2026-62737). This vulnerability allows an authenticated attacker to elevate privileges to SYSTEM level. An exploit has been publicly available since August 11.

Among the remaining vulnerabilities, the following stand out:

🔹 RCE - Windows DNS Server (CVE-2026-62878). This wormable vulnerability allows a remote unauthenticated attacker to execute code on a vulnerable server with elevated privileges. It is recommended to test and install the update as soon as possible, especially on Internet-facing DNS servers.

🔹 RCE - Windows Deployment Services TFTP Server (CVE-2026-62893). This vulnerability, discovered as part of the ZDI (Zero Day Initiative) program, allows an attacker to execute code without authentication or user interaction. TFTP has no authentication mechanism and is available remotely via UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP, which is the standard PXE boot scenario, is vulnerable. The issue results from the lack of validation of the existence of an object before performing operations on it. UDP port 69 should be blocked at the perimeter, but attackers could easily use this vulnerability for lateral movement within an organization. If you're using WDS for deployments, test and install this update quickly.

🔹 RCE - Windows DHCP Server (CVE-2026-62823). Successful exploitation of this vulnerability allows a remote unauthenticated attacker to execute arbitrary code from an adjacent network by sending a specially crafted packet that triggers a heap-based buffer overflow.

🔹 EoP - Microsoft Exchange (CVE-2026-62911). This vulnerability allows a remote authenticated attacker (with Privileges Required: Low according to CVSS) to gain control over the mailboxes of all Exchange users, send and read emails, and download attachments. This vulnerability was demonstrated at Pwn2Own Berlin. ZDI researchers provided Microsoft with working exploits.

🔹 RCE - Microsoft QUIC (CVE-2026-62815). This use-after-free vulnerability allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted network packet. QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP and serves as the foundation for HTTP/3. The protocol is used by approximately 13.5 million websites.

🔹 Tampering - Windows Container Isolation FS Filter Driver (unionfs.sys) (CVE-2026-72971). This vulnerability reportedly allows an attacker to overwrite certain files. As a result, an attacker could perform an action within a container that could impact the host system.

🗒 Full Vulristics report

July Microsoft Patch Tuesday

Leave a reply

July Microsoft Patch Tuesday

July Microsoft Patch Tuesday. In the second week of July, I was on vacation in St. Petersburg. After that, I got caught up with a bunch of other tasks, so I'm only publishing this roundup now. Better late than never, especially considering how unusual this MSPT turned out to be. 😉 In total, 571 vulnerabilities were addressed - almost three times (❗️) more than in June. There are four vulnerabilities that have been reported as exploited in the wild:

🔻 RCE - Microsoft SharePoint (CVE-2026-58644). An attacker with Site Owner privileges or higher can remotely inject and execute arbitrary code on the SharePoint Server.

🔻 RCE - Microsoft SharePoint (CVE-2026-50522). The vulnerability description is identical to CVE-2026-58644. According to ZDI, the CVE-2026-50522 vulnerability was successfully demonstrated at Pwn2Own Berlin. Despite this, Microsoft rates its Exploit Maturity as "Unknown", even though researchers have already provided a working exploit to the company. This once again shows that organizations should not rely solely on software vendors' assessments and should instead perform their own risk evaluation. If you have Internet-facing SharePoint servers, you should test and deploy the patch addressing this vulnerability as soon as possible.

🔻 EoP - Microsoft SharePoint Server (CVE-2026-56164). Missing authentication for a critical function in Microsoft Office SharePoint could allow an unauthenticated attacker to elevate privileges over a network. Microsoft mentioned in the advisory that enabling the Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can help mitigate this flaw.

🔻 EoP - Active Directory Federation Services (CVE-2026-56155). Insufficient granularity of access control (CWE-1220) in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain administrator privileges.

There are eight more vulnerabilities with publicly available exploits:

🔸 EoP - Windows User Interface Core (CVE-2026-50454). Relative path traversal (CWE-23) allows an authorized attacker to elevate privileges locally. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. The PoC starts from a normal, non-elevated process belonging to a local administrator and opens an interactive command prompt as NT AUTHORITY\SYSTEM.

🔸 EoP - Windows WalletService (CVE-2026-49176). Improper privilege management (CWE-269) allows an authorized attacker to elevate privileges locally. The exploit PoC starts a command prompt as SYSTEM in the active desktop session.

🔸 RCE - Microsoft Message Queuing Queue Manager (CVE-2026-54992). The existing exploit PoC demonstrates denial of service; it does not demonstrate code execution.

🔸 EoP - Windows Narrator Braille (CVE-2026-58635). According to Microsoft's description, an attacker who successfully exploited this vulnerability could execute code in the security context of the NT AUTHORITY\Network Service account. However, the description of the exploit PoC states that an unprivileged attacker would gain NT AUTHORITY\SYSTEM privileges.

🔸 EoP - Windows Cloud Files Mini Filter Driver (CVE-2026-58613). Use after free (CWE-416) in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. An attacker who successfully exploits this vulnerability can gain SYSTEM privileges. Exploitation details are available in the Talos Vulnerability Report TALOS-2026-2426.

🔸 InfDisc - Windows Win32k (CVE-2026-50416). An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. The exploit PoC description mentions Chrome tabs, Discord, Explorer, Spotify, and tray windows. However, it seems that it will not be possible to intercept passwords using this vulnerability.

🔸 InfDisc - Windows Kernel (CVE-2026-50475). A buffer over-read (CWE-126) in the Windows Kernel allows an authorized attacker to disclose information locally. Exploitation details are available in the Talos Vulnerability Report TALOS-2026-2443.

🔸 EoP - Azure Spring Apps (CVE-2026-50338). An attacker who successfully exploited this vulnerability could gain elevated privileges, potentially allowing them to perform actions beyond their original permissions. According to the author of the exploit PoC, the vulnerability is a Spring Cloud Azure B2C resource server cross-issuer authentication bypass.

Among the remaining vulnerabilities, the following can be highlighted:

🔹 RCE - Windows Remote Desktop Protocol (CVE-2026-56190). An unauthenticated, network-reachable, no user interaction required vulnerability. The root cause is a classic one: the use of an uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

🔹 RCE - Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) (CVE-2026-55944). Successful exploitation can be achieved by sending a crafted login request to an affected Dynamics NAV or Business Central server in order to trigger a deserialization of untrusted data vulnerability. Microsoft's advisory cautions that no user-interaction is required, nor is authentication a requirement in order to successfully exploit this vulnerability.

🔹 EoP - Microsoft Windows VMSwitch (CVE-2026-57092). It's a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. ZDI reported that a similar exploit was demonstrated on ESXi at Pwn2Own Berlin, but this issue is not limited to ESXi. If you use VMSwitch in Hyper-V deployments (which is likely), test and deploy the fix quickly.

🔹 Spoofing - Microsoft Exchange (CVE-2026-55008). An attacker can send a specially crafted email that runs arbitrary JavaScript when the victim opens it in OWA. No attachment or macro is required - simply viewing the email is enough. If your organization uses OWA, it is recommended to test and deploy the fix as soon as possible.

🔹 RCE - Windows DHCP Server (CVE-2026-50518, CVE-2026-56159, CVE-2026-48564, CVE-2026-50370), Windows DHCP Client (CVE-2026-54128), Windows Message Queuing Service (MSMQ) (CVE-2026-50447), Windows Admin Center (WAC) (CVE-2026-56196), Windows FTP Service (CVE-2026-49172), Windows GDI+ (CVE-2026-50380), Windows Server Network driver (CVE-2026-56188), Microsoft Exchange (CVE-2026-55005), Windows Active Directory Domain Services (CVE-2026-49178), Windows Remote Desktop Client (CVE-2026-50474), Windows Remote Desktop Client (CVE-2026-54990, CVE-2026-58594), Windows TCP/IP (CVE-2026-54999), Windows Print Spooler (CVE-2026-58608), Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2026-54982, CVE-2026-54995), Microsoft SQL Server (CVE-2026-54117), Microsoft Copilot (CVE-2026-48561).

🔹 SFB - Microsoft SharePoint Server (CVE-2026-55040).

🔹 EoP - Windows Server Update Service (WSUS) (CVE-2026-50444), Active Directory Certificate Services (CVE-2026-54121).

There is also a rather curious vulnerability:

RCE - Game: Age of Empires II: Definitive Edition (CVE-2026-50663). 😃 A relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. Age of Empires II is a cult classic real-time strategy game by Microsoft, set in the medieval era. Players develop chosen civilizations, manage resources, research technologies, and command armies in historical campaigns and multiplayer battles. The Definitive Edition features improved graphics, updated audio, and additional content. If you're still playing this game, be sure to update. 😉

🗒 Full Vulristics Report

July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability

Leave a reply

July In the Trend of VM (#29): Microsoft Exchange Server vulnerability

July "In the Trend of VM" (#29): Microsoft Exchange Server vulnerability. Here is my traditional monthly roundup of trending vulnerabilities, according to Positive Technologies. The previous June edition featured four vulnerabilities. This time, there's only one.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

🔻 XSS - Microsoft Exchange (CVE-2026-42897). The vulnerability allows attackers to execute arbitrary JavaScript in a user's browser when the user opens a malicious email in Outlook Web Access (OWA). A public proof-of-concept exploit is available, and the vulnerability has already been exploited in the wild.

🟥 The full list of trending vulnerabilities is available on the portal

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability

Leave a reply

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability. The vulnerability was fixed on May 14 outside the regular Microsoft Patch Tuesday cycle. Improper neutralization of input during web page generation (CWE-79, XSS) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. In practical terms, this means that a remote attacker could exploit this vulnerability by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. As a result, the attacker may gain control of the user's mailbox by using an active user session.

👾 Microsoft experts immediately reported signs of active exploitation in the wild for this vulnerability. The vulnerability was added to the CISA KEV on May 15.

⚒️ A public exploit for the vulnerability was published on GitHub on May 15 as well.

⚙️ Initially, mitigation measures were recommended to address the vulnerability, delivered via the Exchange Emergency Mitigation (EM) service or by using the Exchange on-premises Mitigation Tool (EOMT) script. Security updates that fix the vulnerability in Microsoft Exchange Server Subscription Edition RTM, Exchange Server 2016, and Exchange Server 2019 were released almost a month later, on June 9. Microsoft experts recommended keeping the mitigations enabled even after applying the patch, as they provide an additional layer of protection. However, applying these mitigations may cause issues (for example, errors when printing calendars and displaying images in OWA).

⚠️ Please note that Exchange Server 2016 and 2019, which are out of support, are also affected by this vulnerability. Only customers enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026.

I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies

2 Replies

I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies

I have finalized the list of trending vulnerabilities for 2024 according to Positive Technologies. Last year, 74 vulnerabilities were classified as trending (to compare the scale, just over 40,000 were added to NVD in 2024).

All trending vulnerabilities are found in Western commercial products and open source projects. This year, the vulnerabilities of domestic Russian products did not reach the level of criticality required to classify them as trending.

For 55 of all trending vulnerabilities there are currently signs of exploitation in attacks, for 17 there are public exploits (but no signs of exploitation) and for the remaining 2 there is only a possibility of future exploitation.

Vulnerabilities were often added to trending ones before signs of exploitation in the wild appeared. For example, the remote code execution vulnerability in VMware vCenter (CVE-2024-38812) was added to the list of trending vulnerabilities on September 20, 3 days after the vendor's security bulletin appeared. There were no signs of exploitation in the wild or public exploit for this vulnerability. Signs of exploitation appeared only 2 months later, on November 18.

Most of the vulnerabilities in the trending list are of the following types: Remote Code or Command Execution (24) and Elevation of Privilege (21).

4 vulnerabilities in Barracuda Email Security Gateway (CVE-2023-2868), MOVEit Transfer (CVE-2023-34362), papercut (CVE-2023-27350) and SugarCRM (CVE-2023-22952) were added in early January 2024. These vulnerabilities were massively exploited in the West in 2023, and attacks using these vulnerabilities could also tangentially affect those domestic Russian organizations where these products had not yet been taken out of service. The rest of the vulnerabilities became trending in 2024.

34 trending vulnerabilities affect Microsoft products (45%).

🔹 17 of them are Elevation of Privilege vulnerabilities in the Windows kernel and standard components.

🔹 1 Remote Code Execution vulnerability in Windows Remote Desktop Licensing Service (CVE-2024-38077).

2 trending Elevation of Privilege vulnerabilities affect Linux systems: one in nftables (CVE-2024-1086), and the second in needrestart (CVE-2024-48990).

Other groups of vulnerabilities

🔻 Phishing attacks: 19 (Windows components, Outlook, Exchange, Ghostscript, Roundcube)
🔻 Network security and entry points: 13 (Palo Alto, Fortinet, Juniper, Ivanti, Check Point, Zyxel)
🔻 Virtual infrastructure and backups: 7 (VMware, Veeam, Acronis)
🔻 Software development: 6 (GitLab, TeamCity, Jenkins, PHP, Fluent Bit, Apache Struts)
🔻 Collaboration tools: 3 (Atlassian Confluence, XWiki)
🔻 CMS WordPress plugins: 3 (LiteSpeed Cache, The Events Calendar, Hunk Companion)

🗒 Full Vulristics report

🟥 Article on the official website "Vulnerable software and hardware vs. security researchers" (rus)

На русском

New episode "In The Trend of VM" (#10): 8 trending vulnerabilities of November, zero budget VM and who should look for patches

Leave a reply

New episode "In The Trend of VM" (#10): 8 trending vulnerabilities of November, zero budget VM and who should look for patches. The competition for the best question on the topic of VM continues. 😉🎁

📹 Video on YouTube, LinkedIn
🗞 Post on Habr (rus)
🗒 Digest on the PT website

Content:

🔻 00:29 Spoofing - Windows NTLM (CVE-2024-43451)
🔻 01:16 Elevation of Privilege - Windows Task Scheduler (CVE-2024-49039)
🔻 02:16 Spoofing - Microsoft Exchange (CVE-2024-49040)
🔻 03:03 Elevation of Privilege - needrestart (CVE-2024-48990)
🔻 04:11 Remote Code Execution - FortiManager "FortiJump" (CVE-2024-47575)
🔻 05:19 Authentication Bypass - PAN-OS (CVE-2024-0012)
🔻 06:32 Elevation of Privilege - PAN-OS (CVE-2024-9474)
🔻 07:42 Path Traversal - Zyxel firewall (CVE-2024-11667)
🔻 08:37 Is it possible to Manage Vulnerabilities with no budget?
🔻 09:53 Should a VM specialist specify a patch to install on the host in a Vulnerability Remediation task?
🔻 10:51 Full digest of trending vulnerabilities
🔻 11:18 Backstage

На русском

About Spoofing - Microsoft Exchange (CVE-2024-49040) vulnerability

2 Replies

About Spoofing - Microsoft Exchange (CVE-2024-49040) vulnerability

About Spoofing - Microsoft Exchange (CVE-2024-49040) vulnerability. The vulnerability is from the November Microsoft Patch Tuesday. An incorrectly formulated P2 FROM header processing policy allows an attacker to make his email address look legitimate to the victim (for example, like a work colleague's address). Which, of course, significantly increases the effectiveness of phishing attacks. 😏🪝 The vulnerabilities affect Exchange Server 2019 and Exchange Server 2016.

Microsoft has paused the rollout of the initial patches published on November 12. Their installation led to crashes. New fixes were published by Microsoft only on November 27.

👾 Kaspersky has already observed attempts to exploit this vulnerability. They wrote about this in a blog post on November 26.

На русском