Skip to main content
Mallory
Back to intelligence
widely-deployed-product-advisoryendpoint-software-vulnerabilityidentity-authentication-vulnerabilitycredential-access-method

Microsoft Patches Windows Spoofing Flaws Including NTLM Hash Disclosure Bug

Updated 4d agoFirst seen May 25, 20263 sources

Microsoft disclosed and patched three Windows spoofing vulnerabilities affecting the Windows Security App, Windows Storage, and NTLM authentication components. The issues were tracked as CVE-2025-47956, CVE-2025-49760, and CVE-2025-24054, with the last specifically described as an NTLM Hash Disclosure Spoofing Vulnerability, raising the risk of credential exposure through spoofing-related attack paths.

The advisories were published through Microsoft's Security Update Guide and indicate that multiple core Windows components required security fixes for spoofing weaknesses. For defenders, the disclosures highlight the need to prioritize Microsoft security updates, review systems that rely on NTLM authentication, and assess whether exposed Windows endpoints or storage-related workflows could be abused for impersonation, misleading trust signals, or credential theft.

Share:
Microsoft Patches Windows Spoofing Flaws Including NTLM Hash Disclosure Bug
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

EVENT TIMELINE

How this story unfolded

3 events from the most recent confirmed update back to the earliest known activity.

3 EVENTS
Jul 8, 202511mo ago

Microsoft publishes advisory for CVE-2025-49760

Microsoft published a Security Update Guide entry for CVE-2025-49760, described as a Windows Storage Spoofing Vulnerability. This reflects the public release of Microsoft's advisory for the flaw.

Jun 10, 20251y ago

Microsoft publishes advisory for CVE-2025-47956

Microsoft published a Security Update Guide entry for CVE-2025-47956, identified as a Windows Security App Spoofing Vulnerability. The reference marks the public advisory date for this vulnerability.

Mar 11, 20251y ago

Microsoft publishes advisory for CVE-2025-24054

Microsoft added CVE-2025-24054, an NTLM Hash Disclosure Spoofing Vulnerability, to its Security Update Guide. This indicates public disclosure and availability of Microsoft's advisory information for the issue.

SOURCE COVERAGE

Sources

3 references tracked. Mallory keeps watching after this page renders.

3 SOURCESView all
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.

Microsoft Patches Windows Spoofing Flaws Including NTLM Hash Disclosure Bug | Mallory