Loading story…
Microsoft disclosed and patched three Windows TCP/IP denial-of-service vulnerabilities tracked as CVE-2026-40405, CVE-2026-40413, and CVE-2026-40414. The flaws stem from NULL pointer dereference conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues Important, assigned CVSS scores of 7.5 for CVE-2026-40405 and 7.4 for CVE-2026-40413 and CVE-2026-40414, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication.
Microsoft said CVE-2026-40413 and CVE-2026-40414 are exploitable from an adjacent network, limiting attacks to the same network segment such as a shared switch or virtual network, while CVE-2026-40405 is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a scope change, including scenarios in which a low-privilege Hyper-V guest could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-40414 as an Important Windows TCP/IP denial-of-service vulnerability caused by a NULL pointer dereference, with CVSS 7.4. Microsoft stated it was not publicly disclosed or exploited in the wild, described a possible Hyper-V guest boundary-crossing DoS scenario, and provided an official fix.
Microsoft disclosed CVE-2026-40413 as an Important Windows TCP/IP denial-of-service vulnerability caused by a NULL pointer dereference, with CVSS 7.4. The company said the flaw was not publicly disclosed or exploited, noted adjacent-network attack conditions including a possible Hyper-V guest-to-host DoS scenario, and released a fix.
Microsoft disclosed CVE-2026-40405 as an Important Windows TCP/IP denial-of-service vulnerability caused by a NULL pointer dereference, with CVSS 7.5. Microsoft said it was not publicly disclosed or exploited at publication, assessed exploitation as less likely, and made an official fix available.
Microsoft published a Security Update Guide entry for CVE-2025-21352, an Internet Connection Sharing (ICS) denial-of-service vulnerability. The publication indicates the issue was formally acknowledged and addressed by Microsoft on that date.
Microsoft released Security Update Guide entries for CVE-2024-38232 and CVE-2024-38233, both described as Windows Networking denial-of-service vulnerabilities. Their publication marks formal disclosure and availability of Microsoft guidance or fixes.
Microsoft published a Security Update Guide entry for CVE-2023-36602, a Windows TCP/IP denial-of-service vulnerability. The advisory indicates the vulnerability was formally disclosed and addressed by Microsoft on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-40401**, an **Important** denial-of-service flaw in the Windows TCP/IP stack caused by a `NULL` pointer dereference and assigned it a **CVSS 7.1** score. The company said exploitation requires no privileges or user interaction, has not been publicly disclosed or observed in the wild, and is considered less likely to be exploited. Microsoft has released a security update to address the issue. The advisory warns that the bug can have broader impact in virtualized environments: a low-privilege **Hyper-V** guest could cross the guest boundary and trigger denial of service on the **Hyper-V host**. The disclosure aligns with Microsoft's continued patching of availability issues affecting virtualization components, including prior **Windows Hyper-V** denial-of-service flaws tracked as **CVE-2025-47999** and **CVE-2024-43633**, as well as a **Microsoft Virtual Hard Disk (VHDX)** denial-of-service issue, **CVE-2024-38264**.
Jun 29, 2026
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft disclosed and patched several **Windows Hyper-V elevation of privilege vulnerabilities** tracked as `CVE-2022-21901`, `CVE-2023-36427`, `CVE-2024-43624`, and `CVE-2025-54098`. The advisories identify a recurring security issue affecting Hyper-V components, including one flaw specifically tied to **Hyper-V Shared Virtual Disk**, with each entry published through Microsoft's Security Update Guide and related advisory portals. The vulnerabilities could allow attackers to gain higher privileges on affected Windows systems running Hyper-V, increasing the risk to virtualized environments and hosts that rely on Microsoft's hypervisor stack. Organizations using Hyper-V should review the relevant Microsoft advisories, determine exposure across guest and host infrastructure, and prioritize deployment of the corresponding security updates to reduce the chance of privilege escalation in enterprise virtualization deployments.
Jul 9, 2026