Briefs

CVE-2026-40399 is a stack-based buffer overflow vulnerability in the Windows TCP/IP stack, allowing an authenticated local attacker to elevate privileges.

CVE-2026-40398 is a heap-based buffer overflow vulnerability in Windows Remote Desktop that allows an authorized attacker to elevate privileges locally.

CVE-2026-40397 is an integer underflow vulnerability in the Windows Common Log File System (CLFS) driver that allows an authenticated attacker to escalate privileges locally.

CVE-2026-40382 is a use-after-free vulnerability in the Windows Telephony Service that allows an authorized attacker to elevate privileges locally.

CVE-2026-40381 is a vulnerability in the Azure Connected Machine Agent that allows an authorized attacker to elevate privileges locally due to improper access control.

CVE-2026-40377 is a heap-based buffer overflow vulnerability in Windows Cryptographic Services, allowing an authorized local attacker to elevate privileges.

CVE-2026-40370 allows an authorized attacker with control over file names or paths to execute code over a network in Microsoft SQL Server.

CVE-2026-40369 is an untrusted pointer dereference vulnerability in the Windows Kernel that allows a locally authorized attacker to escalate privileges.

CVE-2026-40368 is a deserialization of untrusted data vulnerability in Microsoft Office SharePoint, allowing an authorized attacker to execute code over a network.

CVE-2026-40367 is an untrusted pointer dereference vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally with a CVSS v3.1 base score of 8.4.

CVE-2026-40366 is a use-after-free vulnerability in Microsoft Office Word allowing local code execution by an unauthorized attacker.

CVE-2026-42898 is a code injection vulnerability in Microsoft Dynamics 365 (on-premises) that allows an authorized attacker to execute arbitrary code over a network.

CVE-2026-42833 is a critical vulnerability in Microsoft Dynamics 365 (on-premises) allowing an authorized attacker with high privileges to execute arbitrary code over the network due to execution with unnecessary privileges.

CVE-2026-42823 is a critical vulnerability in Azure Logic Apps that allows an authorized attacker to elevate privileges over a network due to improper access control.

CVE-2026-41103 describes an incorrect implementation of the authentication algorithm in Microsoft SSO Plugin for Jira & Confluence, allowing an unauthorized attacker to elevate privileges over a network.

CVE-2026-41096 is a critical heap-based buffer overflow vulnerability in Microsoft Windows DNS that allows an unauthenticated attacker to achieve remote code execution over a network.

CVE-2026-41089 is a stack-based buffer overflow vulnerability in Windows Netlogon that allows an unauthorized attacker to execute arbitrary code over a network.

CVE-2026-40402 is a use-after-free vulnerability in Windows Hyper-V, enabling an unauthorized local attacker to escalate privileges.

The rule detects the hijack of the Microsoft Compatibility Appraiser scheduled task to establish persistence with system integrity level, by monitoring CompatTelRunner.exe process execution and detecting unexpected child processes.

This rule detects a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key, evading detection from system utilities.

Detection of suspicious ImagePath values written to the registry, indicating potential persistence or privilege escalation via abnormal service creation involving command interpreters or named pipes.

Modification of the dsHeuristics attribute to exclude groups from SDProp in Active Directory can allow attackers to maintain persistent access to privileged accounts.

Adversaries may modify or replace Windows accessibility binaries (e.g., sethc.exe, utilman.exe) to execute malicious commands or establish persistence mechanisms before a user logs in, potentially leading to elevated privileges and unauthorized access.

Attackers can modify the msDS-AllowedToDelegateTo attribute to KRBTGT, enabling persistent domain access by requesting Kerberos tickets for the KRBTGT service.

This rule detects attempts to establish persistence on Windows endpoints by abusing Microsoft Office add-ins through the creation of malicious files in Office startup directories.

Detects suspicious modifications to the Windows Startup shell folder, a technique used to bypass detections monitoring file creation in the Windows Startup folder.

Detects the creation of a hidden local user account by appending a dollar sign ($) to the account name, a technique used by attackers to persist on a system and evade standard account listing methods.

Detects modifications to the AdminSDHolder object in Active Directory, which attackers can abuse via the SDProp process to implement a persistent backdoor by manipulating permissions on protected accounts and groups to regain administrative privileges.

Microsoft Office Word is vulnerable to CVE-2026-40364, a type confusion vulnerability that allows an unauthorized attacker to execute code locally.

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthenticated, local attacker to execute arbitrary code.