Zero-day — All products

An exploited spoofing flaw and publishing-page fixes

Closes an exploited spoofing vulnerability and fixes several issues, including publishing pages that show the wrong interface and a rich text editor that cannot insert line breaks.

Exploited spoofing flaw patched; pages render again

Addresses an actively exploited spoofing flaw and fixes an issue that kept some pages from rendering. SharePoint Server 2019 updates end July 14, 2026.

Exploited server spoofing flaw addressed; page rendering fixed

Addresses an exploited server spoofing vulnerability and fixes an issue that kept some pages from rendering. It also delivers SharePoint Feature Pack 2, including the SharePoint Framework.

Exploited Shell and MSHTML bypasses patched; startup failure fixed

The update addresses five actively exploited vulnerabilities, including security-feature bypasses in Windows Shell and MSHTML. It also addresses a problem that could prevent Windows from starting.

Exploited Shell and MSHTML bypass flaws patched

Fixes 27 vulnerabilities, including five that attackers are exploiting. It also addresses a WPA3 Wi-Fi connection problem and gaming eligibility checks.

Exploited Shell and MSHTML security bypasses addressed

Addresses 27 vulnerabilities, including exploited Windows Shell and MSHTML security feature bypasses, and fixes several Windows 11 23H2 issues. It also updates Secure Boot components and certificate rollout data.

Exploited Shell and MSHTML flaws patched

Fixes 24 security vulnerabilities, including five that attackers are exploiting, and resolves a restart-on-shutdown issue affecting some Secure Launch PCs with Virtual Secure Mode enabled.

Exploited Shell and MSHTML bypasses patched; shutdown issue fixed

Fixes 22 vulnerabilities, including five that are being exploited, and fixes a shutdown problem on some Secure Launch-capable PCs with Virtual Secure Mode enabled.

Exploited Shell and MSHTML flaws patched; GPU stability fixed

The update fixes 20 vulnerabilities, including two publicly disclosed and exploited Shell and MSHTML security bypasses, and resolves a stability issue on some GPU configurations.

Exploited Shell and MSHTML bypasses patched

Fixes security flaws already being exploited, including Windows Shell and MSHTML security-feature bypasses. It also adds DNS features, while WSUS still does not show synchronization error details.

Exploited Shell and MSHTML bypasses patched; folder names fixed

Fixes 27 security vulnerabilities, including five that are being exploited, and addresses several Windows Server issues. It also adds optional DNS response record shuffling.

Exploited Shell and MSHTML security bypasses patched

Fixes 24 vulnerabilities, including five that attackers are exploiting. It also fixes shutdown, folder-name, and graphics problems.

Exploited Shell and MSHTML bypasses patched; GPU stability fixed

The update patches five exploited vulnerabilities, including Windows Shell and MSHTML security feature bypasses, and fixes a graphics stability issue affecting certain GPU configurations.

Exploited Desktop Window Manager flaw patched; modem drivers removed

The update patches an actively exploited flaw in Desktop Window Manager and removes four older modem drivers, which can leave dependent modem hardware unusable.

Exploited Desktop Window Manager flaw patched; RDP issues addressed

An actively exploited Desktop Window Manager flaw gets a security fix. The update also removes several modem drivers and addresses Remote Desktop connection failures.

Exploited Desktop Window Manager flaw patched; modem drivers removed

The update fixes 73 security vulnerabilities, including an actively exploited Desktop Window Manager flaw, and removes several modem drivers. Some Windows 10 devices might also have trouble saving files to cloud storage.

Exploited Desktop Window Manager flaw gets a security fix

An exploited Desktop Window Manager flaw is patched. Some apps can no longer autofill credentials during remote support or automated sign-in workflows.

Exploited Desktop Window Manager flaw patched; modem drivers removed

The update fixes 51 vulnerabilities, including an exploited Desktop Window Manager information-disclosure flaw, and removes four modem drivers, disabling hardware that depends on them.

An exploited desktop display flaw exposes information

Attackers are exploiting a flaw in the desktop display system to expose information. The update also changes credential input during remote support and includes a known cloud-file issue.

Exploited Desktop Window Manager flaw patched; modem drivers removed

An exploited Desktop Window Manager flaw is addressed, and four modem drivers are removed, so hardware that depends on them stops working.

Exploited DWM flaw patched; modem drivers removed

An actively exploited Desktop Window Manager flaw is patched. The update also removes several modem drivers, so hardware that depends on them stops working.

Exploited Desktop Window Manager flaw patched; modem drivers removed

Fixes an actively exploited Desktop Window Manager flaw, removes four modem drivers, and changes credential autofill and WDS behavior. Review the Secure Boot certificate guidance to avoid possible boot disruption.

Cloud Files driver flaw under attack; File Explorer flash fixed

An actively exploited Cloud Files driver flaw is addressed, and File Explorer’s brief white flash is fixed. The update also includes fixes for virtual switches and other issues.

Closes exploited Cloud Files flaw; adds a PowerShell warning

The update fixes 30 Important vulnerabilities, including an exploited Cloud Files driver flaw. PowerShell 5.1 now warns before running scripts from web content.

PowerShell adds a warning before running web content

The update adds a security warning and confirmation prompt to PowerShell 5.1’s Invoke-WebRequest command. It also includes a fix for an actively exploited Cloud Files driver vulnerability.