Zero-day — All products

Exploited WinSock driver flaw patched; File History backups restored

An exploited WinSock driver flaw is patched, and failed File History network backups are fixed. Secure Boot certificate updates continue to reach eligible devices.

Winsock driver flaw under attack; DFS file previews improved

An actively exploited Winsock driver flaw gets a security fix. File Explorer also handles files on DFS drives better after network reconnects.

WinSock driver flaw under active attack

An actively exploited elevation-of-privilege flaw affects the Ancillary Function Driver for WinSock. The update also improves Secure Boot certificate targeting.

Exploited WinSock flaw patched; SMB backups recover

An actively exploited WinSock driver flaw is patched, and scheduled File History backups to network shares work again. Secure Boot certificate coverage also expands.

Exploited WinSock flaw; File History backup failures fixed

An actively exploited WinSock driver flaw gets a security fix, and scheduled File History backups to SMB shares work again after failing with invalid credentials.

Exploited Shell spoofing flaw; picture-password sign-up ends

A Windows Shell spoofing flaw is already being exploited, and a BitLocker bypass flaw is public. New picture-password enrollment also ends.

Exploited Windows Shell spoofing flaw patched; picture passwords retired

An actively exploited Windows Shell spoofing flaw is patched. New picture passwords can no longer be set up, and the update addresses problems with Office apps and Recycle Bin prompts.

Windows Shell spoofing flaw exploited; RDP adds SHA-2 support

An actively exploited Windows Shell spoofing flaw is addressed. Trusted Remote Desktop publishers can now use SHA-2 certificate thumbprints.

Shell spoofing flaw exploited; Secure Boot and RDP protections updated

A Windows Shell spoofing flaw is already being exploited, and the update adds Secure Boot status reporting and SHA-2 support for trusted RDP publishers. Some keyboard shortcuts might stop responding in rare cases.

Exploited Shell and AD FS flaws patched; Secure Boot coverage expands

Patches exploited Windows Shell and Active Directory Federation Services flaws, and expands automatic Secure Boot certificate coverage. Some keyboard shortcuts might briefly stop working in rare cases.

Exploited AD FS flaw patched; unregistered TDI apps may stop working

Attackers are exploiting an AD FS privilege flaw. This release also tightens TDI transport rules, which might stop apps using unregistered third-party transports.

Actively exploited AD FS and Shell flaws addressed

The update addresses actively exploited flaws in AD FS and Windows Shell, along with a publicly disclosed BitLocker flaw. It also adds cryptography support and fixes several reported problems.

Exploited AD FS flaw patched; BitLocker recovery prompt remains possible

An actively exploited AD FS elevation flaw and a Windows Shell spoofing flaw get security fixes. Check BitLocker settings before installing on affected managed servers.

Exploited AD FS flaw patched; Secure Boot status reporting added

Attackers are exploiting an AD FS privilege flaw, and the update adds Secure Boot status reporting. It also fixes issues in File Explorer, OLE Automation, and the Recycle Bin.

Exploited AD FS flaw prompts new key-container checks

An actively exploited AD FS privilege flaw gets new key-container checks, alongside fixes for OLE Automation, File Explorer, and Recycle Bin problems.

Exploited elevation flaw patched; legacy workflows start again

An exploited elevation-of-privilege flaw is patched, and SharePoint 2010 workflows that failed to start after June's update work again.

Exploited privilege flaw patched; workflow and page fixes

An actively exploited privilege flaw is patched, alongside fixes for page loading and SharePoint 2010 workflows. Support for version 2019 ends on July 14, 2026.

Exploited privilege flaw patched; final update for this version

Attackers are exploiting a SharePoint Server privilege flaw. This is the final update for this version and includes fixes for critical security vulnerabilities.

Critical exploited spoofing flaw patched; mitigation services recover

The update addresses Exchange vulnerabilities, including the actively exploited critical spoofing flaw CVE-2026-42897. It lists eight CVEs, but does not include the fix for CVE-2026-45583; follow that CVE’s guidance.

Mail-server spoofing flaw patched; one remote-code flaw remains open

The update closes Exchange Server vulnerabilities, including a critical spoofing flaw known to be exploited. It does not include a fix for CVE-2026-45583; follow that CVE’s documentation for instructions.

Actively exploited spoofing flaw; mitigation services error fixed

The update addresses seven of the eight listed vulnerabilities, including the critical, actively exploited Exchange spoofing flaw; it does not include the fix for CVE-2026-45583. It also fixes an “Unknown Issuer” error in mitigation and flighting services.

Exchange spoofing flaw exploited; mitigation services error fixed

The update addresses Exchange Server vulnerabilities, including an actively exploited critical spoofing flaw. It does not include the fix for CVE-2026-45583.

Closes exploited remote-code execution flaw; adds 26H1 features

Closes an actively exploited SharePoint remote-code execution flaw (CVE-2026-58644), among 32 vulnerabilities, and introduces the 26H1 feature update alongside several fixes.

Actively exploited remote-code flaw patched; 2019 updates end July 14

Fixes security vulnerabilities in SharePoint Server 2019, including an actively exploited remote-code flaw. Updates for this version end July 14, 2026.

Actively exploited remote-code flaw patched before support ends

The update patches an actively exploited remote-code execution flaw and other vulnerabilities. SharePoint Server 2016 updates end on July 14, 2026.