Loading story…
Microsoft patched a critical Windows kernel elevation-of-privilege flaw, CVE-2026-40369, affecting Windows 11 versions 24H2 through 25H2 after public disclosure of technical details and proof-of-concept exploit code. The bug resides in ntoskrnl.exe, specifically nt!ExpGetProcessInformation, and can be triggered via NtQuerySystemInformation, including a zero-length request tied to information class 253, causing an untrusted pointer dereference and unsafe kernel memory writes from an unprivileged process.
Researchers said the vulnerability enables deterministic kernel memory modification, allowing attackers to build kernel read primitives, bypass KASLR, locate structures such as EPROCESS, alter token privileges, and ultimately obtain NT AUTHORITY\SYSTEM execution. Because the flaw is reachable from Chrome, Edge, and Firefox renderer sandboxes, it is considered especially dangerous for browser escape chains; defenders were urged to prioritize patching and watch for unusual NtQuerySystemInformation activity and anomalous kernel interaction patterns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft addressed the Windows kernel elevation-of-privilege vulnerability CVE-2026-40369 in its May Patch Tuesday security updates. The flaw affects Windows 11 versions 24H2 through 25H2 and resides in nt!ExpGetProcessInformation.
Researcher Ori Nimron publicly disclosed technical details for CVE-2026-40369, including that it can be triggered via NtQuerySystemInformation and abused for kernel memory modification and privilege escalation. Public proof-of-concept exploit code was also released, highlighting potential use in browser sandbox escape chains affecting Chrome, Edge, and Firefox.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcegithub.com
Open sourcepwn2nimron.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a critical elevation-of-privilege vulnerability in the Windows Kernel, tracked as CVE-2025-62215, which is being actively exploited in the wild. The flaw arises from a race condition and improper memory management, specifically a double-free scenario, allowing local attackers to escalate privileges to SYSTEM level. Exploitation requires an attacker to already have access to the system, but no user interaction is needed, and the attack can be automated. Microsoft has rated the vulnerability as Important, with a CVSS score of 7.0, and notes that all supported Windows 10 editions are affected, including those under Extended Security Updates (ESU). No workaround is available other than applying the official update, and immediate patching is strongly recommended. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-415 (Double Free), making it a classic post-compromise privilege escalation vector. Attackers can exploit the timing-sensitive memory corruption path in the kernel to gain elevated access, disable security defenses, and move laterally within networks. The attack surface is particularly concerning in enterprise environments where multiple users share access, as any authenticated user can potentially trigger the exploit. Security experts warn that both targeted threat actors and ransomware operators may leverage this flaw to deepen their foothold after initial access, emphasizing the urgency of deploying the security update across all affected systems.
Jul 4, 2026
SafeBreach Labs disclosed **CVE-2025-59199**, a Windows 11 sandbox escape that allows a low-integrity process to gain medium-integrity code execution and perform arbitrary file writes after a single user click. The attack, dubbed **"Click Or Trick,"** chains weaknesses across several Windows components rather than exploiting one isolated flaw, combining a misconfigured COM object, Windows app identity and toast notification behavior, Snipping Tool URI handling, URI decoding quirks, and Microsoft Teams' exposed Chromium remote debugging interface. Researchers showed an attacker could launch a medium-integrity COM server from a low-integrity context, spoof a trusted toast notification, append attacker-controlled command-line arguments to legitimate applications, and then abuse the Chrome DevTools Protocol to write files outside the sandbox. Microsoft assigned the issue a **CVSS 7.8** score after it was reported on July 13, 2025, and released a patch on October 14, 2025; the findings underscore how security gaps at the boundaries between unrelated Windows subsystems can be combined into a practical sandbox escape chain.
Jun 29, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting core operating system components, including **Windows Secure Kernel Mode**, the **Windows kernel**, and **NTFS**. The issues were tracked as `CVE-2024-43646`, `CVE-2025-21325`, `CVE-2025-49678`, and `CVE-2025-59207`, and were published through the Microsoft Security Response Center's Security Update Guide. The vulnerabilities span privileged parts of Windows that, if exploited, could allow an attacker to gain higher permissions on a compromised system. The affected areas include secure kernel functionality, general kernel operations, and the NTFS file system, underscoring continued risk from local privilege-escalation bugs in foundational Windows components and the importance of applying Microsoft security updates promptly.
Jul 4, 2026