Microsoft
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 1975Source: Wikidata
- Sector
- Software development, Software industrySource: Wikidata
- Official website
- www.microsoft.comSource: Wikidata
Vulnerabilities
372 CVEs in our records, 2 known exploited (on CISA's KEV list).
- CVE-2026-111497 Exploited added to KEV 27 Oct
- CVE-2026-96951 Exploited added to KEV 13 Oct
Products we track
Security timeline
- Vulnerability reported by Cyber Security NewsPublic proof-of-concept released for patched Windows WinSock privilege escalation flaw CVE-2023-21768
- Named in breach reports by The Hacker NewsAttackers posing as IT support on Teams abused AD CS to obtain privileged certificates
- Advisory or policy news by CSO OnlineConfig files for AI coding assistants can run commands on developer machines, so reviews must check them
- Vulnerability reported by Help Net SecurityEmbedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
- Malware reported by Help Net SecurityTampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
- Malware reported by The RecordNetamLoader malware targets custom Windows 10 build used by Asian government bodies
- Security update reported by BleepingComputerMicrosoft fixes Windows 11 Remote Desktop failures affecting non-admin users with Administrator protection
- Activity reported by Microsoft Security BlogTeams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
Recent news · 11 stories
Public proof-of-concept released for patched Windows WinSock privilege escalation flaw CVE-2023-21768
A public proof-of-concept exploit for CVE-2023-21768 targets the afd.sys Windows kernel driver and lets a local user with low privileges gain SYSTEM rights, with the full chain reported working on Windows 11 22H2. Microsoft patched the flaw in January 2023, and IBM published the researchers' analysis on 21 March 2023. The exploit does not provide a direct remote route in.
Attackers posing as IT support on Teams abused AD CS to obtain privileged certificates
Attackers impersonated IT support over Microsoft Teams to persuade employees to grant remote control of their PCs. They then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain login certificates for privileged accounts, including a domain controller. Microsoft reported investigating two such intrusions, one of which resulted in company data being stolen; the excerpt is truncated.
Config files for AI coding assistants can run commands on developer machines, so reviews must check them
The article argues that merging a configuration change for an AI coding assistant can distribute execution instructions to everyone working in the repository. It cites StepSecurity's October 8 analysis of the June Miasma campaign, which planted AI-tool and editor configuration in a Microsoft repository to harvest credentials, and recommends named owners, enforced review through branch protection, and checks on user-level and shared skills and plugins.
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.
Marks and Spencer Oxford Street sign appears to show Windows 10 error from low disk space
A Register reader spotted a Marks and Spencer food hall sign on Oxford Street that appears to show a Windows 10 low disk space warning. The reader suspects Windows 10 21H2 LTSC is behind it, and the article notes that Windows 10 LTSC 2021 remains supported until January 2027. The piece also recalls M&S's 2025 cyber attack, which reportedly cost around £136 million in cleanup.
Russia again pulls VPN apps from Apple's App Store, EFF calls it a crackdown
VPN app developers report that their products have again been removed from Apple's App Store in Russia. The EFF says this follows earlier Roskomnadzor action against VPN apps and a Russian move to add Apple and Microsoft to its state surveillance registry, which reportedly gives authorities access to local users' correspondence.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.
Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
Phorion researchers found that Claude Code extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for VS Code-compatible editors. BleepingComputer reports it was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. Microsoft's Visual Studio Marketplace never carried the compromised build.
NetamLoader malware targets custom Windows 10 build used by Asian government bodies
Kaspersky's GReAT team reported NetamLoader, a .NET and XAML-based loader found in a CAB archive in the Windows update download folder, built for a custom Windows 10 build used only by Asian government bodies. It abuses Microsoft-signed components, patches AMSI, cleans up logs and contacts its C2 server slowly to evade sandboxes and EDR. Kaspersky saw one victim, could not say how the archive was delivered and found no sign that Patch My PC was compromised.
Microsoft fixes Windows 11 Remote Desktop failures affecting non-admin users with Administrator protection
Microsoft has resolved a Windows 11 issue where non-admin users could not connect over Remote Desktop to hosts with Administrator protection enabled, failing with error 0xC000000D and the message 'The token that was passed to the function is invalid.' The bug appeared after the 22 September non-security preview update KB5124010 or later, and affects Windows 11 24H2, 25H2, 26H1 and 26H2, with Windows Server not listed. The fix is in updates released on or after 28 October, including preview update KB5127936 for 25H2 and 26H2.