Tag Archives: Windows

March “In the Trend of VM” (#25): once again, vulnerabilities are only in Microsoft products

Leave a reply

March In the Trend of VM (#25): once again, vulnerabilities are only in Microsoft products

March “In the Trend of VM” (#25): once again, vulnerabilities are only in Microsoft products. I present the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. As in February, it turned out to be quite compact and focused on a single vendor.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

All four vulnerabilities are from the February Microsoft Patch Tuesday, and all are actively being exploited in the wild:

🔻 RCE – Windows Shell (CVE-2026-21510)
🔻 RCE – Microsoft Word (CVE-2026-21514)

💬 Microsoft classified the two vulnerabilities above as Security Feature Bypass, but in fact, they are Remote Code Execution.

🔻 EoP – Windows Remote Desktop Services (CVE-2026-21533)
🔻 EoP – Desktop Window Manager (CVE-2026-21519)

🟥 The full list of trending vulnerabilities can be found on the portal

About Elevation of Privilege – Desktop Window Manager (CVE-2026-21519) vulnerability

Leave a reply

About Elevation of Privilege - Desktop Window Manager (CVE-2026-21519) vulnerability

About Elevation of Privilege – Desktop Window Manager (CVE-2026-21519) vulnerability. The vulnerability is from the February Microsoft Patch Tuesday. Desktop Window Manager is a compositing window manager included in Windows starting with Windows Vista. A Type Confusion error (CWE-843) in Desktop Window Manager allows an authorized attacker to locally elevate privileges to the SYSTEM level. By fixing this vulnerability, Microsoft most likely attempted to counter the same attacker who exploited the January Information Disclosure vulnerability (CVE-2026-20805) in the same component. It is possible that the original fix did not fully resolve the issue.

👾 Microsoft reports that the vulnerability has been exploited in the wild. The vulnerability has been in the CISA KEV since February 10.

🛠 No public exploits are available yet.

На русском

About Elevation of Privilege – Windows RDS (CVE-2026-21533) vulnerability

Leave a reply

About Elevation of Privilege - Windows RDS (CVE-2026-21533) vulnerability

About Elevation of Privilege – Windows RDS (CVE-2026-21533) vulnerability. The vulnerability is from the February Microsoft Patch Tuesday. Remote Desktop Services (RDS) is a component of Microsoft Windows that allows a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection using the Remote Desktop Protocol (RDP). Improper Privilege Management (CWE-269) in Windows Remote Desktop allows a local attacker to gain SYSTEM privileges. According to CrowdStrike, the exploit binary modifies a service configuration key, allowing the attacker to elevate privileges and “add a new user to the Administrator group”.

👾 Microsoft reports exploitation of the vulnerability in the wild. The vulnerability has been listed in the CISA KEV since February 10.

🛠 No public exploits are available yet, but there are reports of the exploit being advertised for sale for $220,000 on a dark forum.

На русском

March Microsoft Patch Tuesday

Leave a reply

March Microsoft Patch Tuesday

March Microsoft Patch Tuesday. A total of 79 vulnerabilities, about one and a half times more than in February. What’s truly unusual is that this time there were no vulnerabilities with signs of exploitation in the wild or a public exploit! 🤔 At least not yet. 😏

The following vulnerabilities can be highlighted:

🔹 RCE – Print Spooler (CVE-2026-23669), Office (CVE-2026-26110, CVE-2026-26113), Excel (CVE-2026-26107, CVE-2026-26108, CVE-2026-26109, CVE-2026-26112), SharePoint Server (CVE-2026-26106, CVE-2026-26114)
🔹 EoP – SQL Server (CVE-2026-21262, CVE-2026-26115, CVE-2026-26116), Windows Kernel (CVE-2026-24287, CVE-2026-24289, CVE-2026-26132), Windows Win32k (CVE-2026-24285), SMB Server (CVE-2026-24294, CVE-2026-26128), Windows Graphics Component (CVE-2026-23668), .NET (CVE-2026-26131)
🔹 DoS – .NET (CVE-2026-26127)

🗒 Full Vulristics report

На русском

About Remote Code Execution – Windows Shell (CVE-2026-21510) vulnerability

Leave a reply

About Remote Code Execution - Windows Shell (CVE-2026-21510) vulnerability

About Remote Code Execution – Windows Shell (CVE-2026-21510) vulnerability. A vulnerability from the February Microsoft Patch Tuesday. The Windows Shell is the primary interface through which users interact with the Windows operating system. It includes visible elements such as the Desktop, Taskbar, and the Start Menu. Protection Mechanism Failure (CWE-693) allows an attacker to execute arbitrary code on the system by bypassing the Windows SmartScreen mechanism and Windows Shell warnings. To exploit the vulnerability, an attacker needs to convince a user to open a specially crafted shortcut file (.LNK) or follow a malicious link.

👾 Microsoft reports exploitation in the wild. The vulnerability has been listed in the CISA KEV since February 10.

💬 Microsoft classified the vulnerability as Security Feature Bypass, however it seems more appropriate to classify it as Remote Code Execution.

🛠 No public exploits are available yet.

На русском

February “In the Trend of VM” (#24): vulnerabilities in Microsoft products

Leave a reply

February In the Trend of VM (#24): vulnerabilities in Microsoft products

February “In the Trend of VM” (#24): vulnerabilities in Microsoft products. A traditional monthly roundup of trending vulnerabilities. This time, compact and all-Microsoft.

🗞 Post on Habr (rus)
🗒 Digest on the PT website (rus)

In total, two vulnerabilities:

🔻 RCE – Microsoft Office (CVE-2026-21509)
🔻 InfDisc – Desktop Window Manager (CVE-2026-20805)

🟥 Trending Vulnerabilities Portal

На русском

February Microsoft Patch Tuesday

Leave a reply

February Microsoft Patch Tuesday

February Microsoft Patch Tuesday. A total of 55 vulnerabilities, half as many as in January. There are as many as six (❗️) vulnerabilities being exploited in the wild:

🔻 SFB/RCE – Windows Shell (CVE-2026-21510)
🔻 SFB/RCE – Microsoft Word (CVE-2026-21514)
🔻 SFB – MSHTML Framework (CVE-2026-21513)
🔻 EoP – Windows Remote Desktop Services (CVE-2026-21533)
🔻 EoP – Desktop Window Manager (CVE-2026-21519)
🔻 DoS – Windows Remote Access Connection Manager (CVE-2026-21525)

There is also one vulnerability with a public exploit:

🔸 DoS – libjpeg (CVE-2023-2804)

Notable remaining vulnerabilities:

🔹 RCE – Windows Notepad (CVE-2026-20841)
🔹 Spoofing – Outlook (CVE-2026-21511)
🔹 EoP – Windows Kernel (CVE-2026-21231, CVE-2026-21239, CVE-2026-21245), Windows AFD.sys (CVE-2026-21236, CVE-2026-21238, CVE-2026-21241)

🗒 Full Vulristics report

На русском