Microsoft's July 2026 Patch Tuesday discloses 622 vulnerabilities, including 57 critical-severity issues spanning RCE, elevation of privilege, spoofing, and security feature bypass across Windows components, Office, SharePoint, SQL Server, Dynamics, and cloud services. Two vulnerabilities — an AD FS elevation of privilege flaw (CVE-2026-56155) and a SharePoint spoofing flaw (CVE-2026-56164) — are confirmed exploited in the wild, and 11 critical RCE issues plus several important EoP flaws are rated 'more likely' to be exploited by Microsoft. Cisco Talos has released Snort 2 and Snort 3 rule updates to detect exploitation attempts for a subset of the disclosed vulnerabilities.
Microsoft Office
11 posts
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities Threat landscape for industrial automation systems. Q1 2026 Kaspersky's Q1 2026 ICS threat landscape report indicates a continued overall decline in malware blocked on industrial automation systems, reaching 19.6%. However, specific regions like Southern Europe and industries like biometric systems saw notable increases in threats, particularly from malicious scripts, phishing, and spyware. The report highlights the persistent risk to OT environments from common threat vectors like internet browsing and email.
April 2026 CVE Landscape In April 2026, 37 high-impact vulnerabilities were actively exploited, heavily impacting enterprise systems and edge infrastructure. Notable exploitation includes the delivery of the Nexcorium botnet via CVE-2024-3721 in TBK DVR devices and complete service takeovers of Nginx UI instances via CVE-2026-33032, a missing authentication flaw.
Intelligence Center Microsoft's May 2026 Patch Tuesday addresses 137 vulnerabilities, including 31 critical flaws, 16 of which are Remote Code Execution (RCE) vulnerabilities. While no active exploitation has been observed, critical flaws affect core services like Windows Netlogon, DNS Client, and Azure Managed Instances, prompting the release of Snort detection rules by Cisco Talos.
Exploits and vulnerabilities in Q1 2026 In Q1 2026, vulnerability registrations continued to rise, heavily influenced by AI-assisted discovery tools. Threat actors and APT groups actively exploited a mix of legacy and newly discovered vulnerabilities across Windows, Linux, and Microsoft Office, frequently utilizing C2 frameworks like Metasploit and Sliver to bypass authentication and gain initial access.
Weaponizing Apathy: How Threat Actors Exploit Vulnerabilities and Legitimate Software Threat actors are increasingly weaponizing legitimate software and known vulnerabilities to bypass endpoint detection and response (EDR) systems. Between December 2021 and December 2024, the abuse of legitimate Remote Access Tools (RATs) like NetSupport Manager and ConnectWise has surged, often delivered via phishing emails exploiting older Microsoft Office vulnerabilities to establish persistent, stealthy access.
Intelligence Center Microsoft's April 2026 Patch Tuesday addresses 165 vulnerabilities, including 8 critical flaws and one actively exploited zero-day vulnerability in Microsoft Office SharePoint (CVE-2026-32201). The update resolves critical Remote Code Execution (RCE) vulnerabilities across various components such as the Remote Desktop Client, Microsoft Office, Windows IKE, Active Directory, and TCP/IP.
CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA has added two actively exploited vulnerabilities, CVE-2009-0238 (Microsoft Office RCE) and CVE-2026-32201 (Microsoft SharePoint Server Improper Input Validation), to its Known Exploited Vulnerabilities (KEV) Catalog. Organizations are strongly urged to prioritize timely remediation of these vulnerabilities to reduce their exposure to cyberattacks.
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities The Russia-aligned APT group Pawn Storm has launched a sophisticated campaign deploying the PRISMEX malware suite against Ukrainian and NATO defense supply chains. The attack chain leverages two critical vulnerabilities, CVE-2026-21509 and CVE-2026-21513, to achieve zero-click execution, utilizing advanced steganography and COM hijacking to evade detection while communicating via legitimate cloud services.
Boggy Serpens Threat Assessment Boggy Serpens (MuddyWater) is conducting ongoing cyberespionage campaigns targeting critical infrastructure and diplomatic entities globally. The group leverages hijacked accounts for trusted relationship compromises, delivering advanced, AI-assisted malware toolkits including Rust-based backdoors and custom C2 protocols to maintain long-term persistence and evade detection.
SloppyLemming Deploys BurrowShell and Rust-Based RAT to Target Pakistan and Bangladesh Between January 2025 and January 2026, the India-nexus threat actor SloppyLemming conducted a cyber espionage campaign targeting government and critical infrastructure in Pakistan and Bangladesh. The campaign utilized PDF and Excel lures to deploy two custom implants—an in-memory shellcode backdoor named BurrowShell and a Rust-based keylogger—via DLL search order hijacking and extensive abuse of Cloudflare Workers infrastructure.
