Microsoft
CISA Flags Exploited Outlook Spoofing and NTLMv2 Disclosure VulnerabilityNew!!
CISA flags exploited Outlook spoofing. Apply the matching Office security update, restart clients, review authentication exposure, and retain evidence.
CISA Adds Microsoft SharePoint Code Injection to KEV
CISA lists an exploited SharePoint code-injection flaw requiring a low-privilege authenticated attacker but no further user interaction. Update every affected farm server through Microsoft's supported workflow and preserve evidence for forensic triage.
CVE-2026-21509: Microsoft Office OLE security-feature bypass
Opening a malicious Office file can bypass OLE protections; Preview Pane is excluded. Available edition-specific updates supersede old pending-patch wording, but conflicting registry instructions remain unresolved and service-side protection requires restarting Office applications.
CVE-2026-20805: Desktop Window Manager local information disclosure
An authorized local attacker can obtain a Desktop Window Manager user-mode memory section address. This disclosure does not itself establish SYSTEM access or code execution; match the January update and investigate suspected follow-on activity separately.
CVE-2009-0556: Legacy PowerPoint file code execution
A crafted file can corrupt memory and execute code when opened in affected legacy PowerPoint versions, using the logged-on user's rights. Match this CVE's specific products rather than the whole bulletin, and migrate unsupported Office.
CVE-2026-21533: Windows Remote Desktop Services local privilege escalation
Remote Desktop Services can elevate an authorized local attacker to SYSTEM; this is not an unauthenticated network RDP entry point. Match Windows edition and servicing type to the update, then review local-session and endpoint evidence.
CVE-2026-21525: Windows Remote Access Connection Manager denial of service
Windows RasMan's NULL-pointer flaw permits local denial of service, not remote code execution. Preserve service-crash context and apply the matching Windows update; restarting the service may restore availability without repairing the vulnerable code.
CVE-2026-21519: Desktop Window Manager local privilege escalation
Desktop Window Manager type confusion can elevate an authorized local attacker to SYSTEM. Use this CVE's Windows update mapping and review privilege transitions; the flaw is distinct from DWM's separate information-disclosure issue.
CVE-2026-21514: Microsoft Word OLE protection bypass
Microsoft describes Word's flaw as an OLE protection bypass requiring a malicious file to be opened; Preview Pane is excluded. CISA instead describes local privilege escalation, a source disagreement retained alongside platform-specific update guidance.
CVE-2026-21513: Windows MSHTML security-feature bypass
Opening a malicious HTML file or shortcut can bypass MSHTML security prompts and permit attacker-controlled execution. The network attack vector does not mean zero-click; preserve file-origin evidence and apply the matching Windows update.