Microsoft News Articles

Week in review: FortiBleed is still active, Patch Tuesday forecast - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Three questions a hospital CISO should ask a healthcare

2 days ago

Microsoft Exchange Vulnerability Could Leak Confidential Organizational Info - IT Security News

Microsoft has issued an emergency security update to fix a vulnerability in Exchange Server that could expose confidential organizational communications. The flaw, tracked as CVE-2026-96940, has received a...

4 days ago

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft patches CVE-2026-96940, which lets authenticated attackers read other users' Exchange mailboxes within the same organization.

1 week ago

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) - IT Security News

2026-10-05 13:10 Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity vulnerability (CVE-2026-96940) that may allow authenticated attackers...

1 week ago

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) - Help Net Security

Microsoft released out-of-band Exchange Server security update that fixes a high-severity mailbox access vulnerability (CVE-2026-96940).

1 week ago

Microsoft Warns Exchange Admins to Patch Critical Flaw Immediately

Microsoft patched CVE-2026-96940, a critical Exchange Server flaw that could let authenticated attackers access other users' mailboxes.

1 week ago

(TLP:CLEAR) Weekly Vulnerabilities to Prioritize – October 1, 2026 - WaterISAC

The below vulnerabilities have been identified by WaterISAC analysts as important for water and wastewater utilities to prioritize in their vulnerability management efforts. WaterISAC shares critical...

2 weeks ago

CISA Warns of Microsoft SharePoint Code Injection Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft SharePoint code injection vulnerability, tracked as CVE-2026-65660, to its KEV Catalog after evidence showed the flaw was being exploited in attacks.

2 weeks ago

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild - SwapUpdate

Ravie LakshmananSep 26, 2026Vulnerability / Network Security

2 weeks ago

Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

Microsoft confirmed active exploitation of SharePoint flaw CVE-2026-65660, prompting CISA to add the RCE bug to its KEV list.

2 weeks ago

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

CISA adds exploited SharePoint RCE and RouterOS flaws to KEV; the RouterOS chain can give unauthenticated administrative access.

2 weeks ago

Microsoft SharePoint Flaw Lets Attackers Execute Code Remotely With Low Privileges

Microsoft has confirmed a high-severity remote code execution vulnerability in on-premises SharePoint Server that lets an authenticated, low-privileged attacker run arbitrary code over a network without user interaction.

3 weeks ago

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

SharePoint CVE-2026-65660 enables authenticated RCE; Microsoft patched it on August 11, and no in-the-wild exploitation is reported.

3 weeks ago

Windows COM Flaw Lets Attackers Gain SYSTEM Privileges With a Malicious DLL

A newly detailed Windows privilege escalation flaw tracked as CVE-2026-66804 allowed a standard, low-privileged user to plant a malicious DLL and execute arbitrary code with full NT AUTHORITYSYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model (COM) regist...

3 weeks ago

Microsoft Defender Falls Into a Patch-and-Bypass Cycle

A researcher says ShieldCrash bypasses Microsoft’s latest Defender fix, extending a patch-and-bypass chain involving RoguePlanet and ShieldBreak.

ShieldCrash exploit claims Microsoft Defender bypass

A researcher released ShieldCrash on September 8, claiming it bypasses Microsoft's Defender fix for flaw CVE-2026-69414. Microsoft hasn't confirmed it.

Microsoft Fixes 974 Flaws in Record Patch Tuesday

Microsoft’s record September Patch Tuesday fixes 974 vulnerabilities, including two exploited zero-days. Here’s what IT teams should prioritize.

New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM

ShieldCrash claims Microsoft Defender remains vulnerable to arbitrary file reads with SYSTEM privileges, despite the CVE-2026-69414 fix.

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor - Help Net Security

On September 2026 Patch Tuesday Microsoft delivered a record-breaking number of patches, including for two bugs exploited as zero-days.

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

A Microsoft Defender patch bypass PoC demonstrates arbitrary file read as SYSTEM on the latest Windows version.

Hundreds of old, vulnerable Exchange servers remain in Australia

Key points 382 Australian and 56 New Zealand Exchange servers remain vulnerable to CVE-2026-62911 as of August 31, three weeks after Microsoft's fix. Working exploit code is now publicly available, and...

Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Anthropic locks out Claude users after infostealers