Update, 22 August 2026: Microsoft has told BleepingComputer that it mistakenly marked a maximum-severity Microsoft Entra ID vulnerability as exploited in the wild. The correction removes the strongest public claim behind the first version of this article. It does not…
A critical SharePoint deserialization flaw is under active exploitation. Applying the security update closes the entry point, but stolen machine keys can preserve attacker access unless recovery goes further.
Microsoft Paint and Photos embed server-issued identifiers into locally generated AI images, joining remote moderation, pixel watermarking and C2PA provenance.
A public LegacyHive proof of concept exposed a Windows privilege-escalation path after July's updates. Microsoft patched it in August, showing how public research can compress the defender's window.
ExfilSquad’s leaked data points to exposed Dataverse records, not a confirmed Dynamics exploit. Anonymous low-code permissions can be the entire breach path.
Microsoft will retire its Entra SMS and voice authentication service in February 2027, making passkey migration and exception governance urgent.
ShieldBreak is now CVE-2026-69414, a Microsoft Defender elevation-of-privilege vulnerability assessed as exploitation more likely and still awaiting a verifiable fix. This update separates it from RoguePlanet CVE-2026-50656, explains the different CFAPI attack path, conflicting Windows 11 reproduction results, affected-build uncertainty, and the operational controls security teams should use instead of treating patch deployment as proof that exposure is fixed.
Exploit code for CVE-2026-55040, a Microsoft SharePoint authentication bypass, was weaponised almost immediately after Rapid7 published its analysis. With thousands of SharePoint servers exposed online and a separate SharePoint flaw now tied to ransomware, administrators should treat patching, exposure reduction and compromise checks as one urgent task.
Microsoft’s August 2026 updates fix a WinSock privilege-escalation flaw used by North Korea’s Lazarus group against defence, aerospace and aviation organisations. The exploit helped Operation Dream Job turn a local Windows foothold into SYSTEM access, deploy a kernel rootkit and interfere with endpoint-security controls.
Microsoft has identified a new ransomware strain deployed by China-linked Storm-1175. The campaign coincides with active exploitation of N-able N-central, although the specific entry route remains unconfirmed.
