microsoft
U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them by specific deadlines. The vulnerabilities affect Cisco Secure Firewall, Microsoft Windows, and Metabase, with the Metabase flaw being a critical SQL injection that was actively exploited.
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Threat actors are actively exploiting a critical Microsoft SharePoint vulnerability, CVE-2026-55040, following the public release of a proof-of-concept (PoC) exploit. This security feature bypass allows unauthenticated attackers to impersonate users and potentially modify data by exploiting weaknesses in JWT token validation. Microsoft had previously patched this flaw in its July 2026 updates.
Microsoft Named Leader in Enterprise MDR/MXDR Report
Microsoft has been recognized as a leader in the 2026 IDC MarketScape report for Managed Detection and Response (MDR) and Managed Extended Detection and Response (MXDR) services for enterprises. The report highlights the increasing complexity of cyber threats, including AI-driven attacks, and the need for expert-led services to defend against them. Microsoft's offering, Defender Experts MDR, is described as a round-the-clock service that leverages the Microsoft Defender platform and human expertise to detect, investigate, and respond to security incidents.
CISA Adds Fortinet and Microsoft Flaws to Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical vulnerabilities affecting Fortinet FortiSandbox and Microsoft SharePoint to its Known Exploited Vulnerabilities catalog. The flaws include OS command injection in FortiSandbox and a deserialization vulnerability in SharePoint that allows for remote code execution without authentication. Microsoft has confirmed active exploitation of the SharePoint flaw.
Microsoft SharePoint Server RCE Vulnerability Exploited in the Wild
Microsoft has released a security advisory for CVE-2026-58644, a critical vulnerability in on-premises SharePoint Server versions that allows unauthenticated remote code execution. The flaw, stemming from untrusted data deserialization, has been actively exploited and added to CISA's Known Exploited Vulnerabilities catalog. Organizations are urged to apply security updates immediately and monitor for exploitation attempts.
Microsoft Discusses AI and Supply Chain Threats at Black Hat
Microsoft Security will present at Black Hat USA 2026 on how threat actors are targeting trusted systems, including software, services, and AI, to scale their attacks. The company will share insights into identifying these threats earlier and how threat intelligence, response, and security operations can collaborate across various systems. Sessions will cover the increasing ease of offensive capabilities and deep dives into hunting supply chain attacks within software ecosystems and developer workflows.
AI to Drive More Windows Security Updates, Microsoft Says
Microsoft anticipates a rise in security updates for Windows due to its growing use of artificial intelligence. The company is leveraging AI to proactively identify vulnerabilities within its software, aiming to enhance overall system security.
Microsoft to Retire OWA Light Client in Exchange Server
Microsoft is planning to remove Outlook Web Access (OWA) Light, a simplified version of its web-based email client, in an upcoming Exchange Server update. This move will likely encourage users to adopt the full Outlook Web App for a more feature-rich experience.
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft has developed an internal AI system to proactively evaluate and strengthen its cloud infrastructure. This system operates at AI speed to match the scale and complexity of Microsoft's hyper-scale environments, ensuring security controls are robust and effective. While not a customer-facing product, the insights gained will inform future product improvements.
Microsoft to enable Windows settings backup by default for orgs
Microsoft is making its Windows settings backup and restore feature the default for business organizations. This update will automatically apply to devices managed by Microsoft Entra that are upgraded to Windows 11 version 26H2.
Microsoft testing new Cloud Rebuild Windows 11 recovery feature
Microsoft is piloting a new Cloud Rebuild feature for Windows 11 through its Insider Preview program. This functionality aims to simplify the recovery process for users by allowing them to rebuild their operating system from the cloud. The feature is currently available to testers in the Experimental channel.
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website
Attackers are exploiting a legitimate Microsoft authentication feature, the Device Authorization Grant, to conduct phishing attacks. This method bypasses traditional URL checking by directing users to input codes on trusted Microsoft domains. The attack leverages the protocol designed for input-constrained devices, tricking users into authorizing malicious access.
Improving security posture across the Microsoft partner ecosystem
Microsoft is detailing its strategy for enhancing security within its partner ecosystem, particularly focusing on Cloud Solution Providers (CSPs). These partners are crucial for deploying and managing Microsoft cloud services like Azure and Microsoft 365. The company aims to ensure the partner network remains healthy, compliant, and effective to deliver optimal customer outcomes.
Microsoft named a leader in the Frost Radar for cloud and application runtime security
A new report from Frost & Sullivan identifies Microsoft as a leader in cloud and application runtime security. The report highlights a market shift towards contextual risk reduction, focusing on how exposures combine across infrastructure and applications to create exploitable attack paths. Microsoft's position is attributed to its extensive ecosystem, the capabilities of Microsoft Defender for Cloud integrated with Defender XDR, and its large customer base.
Accelerating the quantum-safe timeline
Microsoft is accelerating its timeline for transitioning to post-quantum cryptography (PQC) due to advancements in quantum research and government guidance. The company aims to have its products and services ready for PQC by 2029, encouraging organizations to begin their transition sooner to mitigate risks and costs associated with this multi-year engineering effort.
Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap
Microsoft has made Azure AD Graph Activity Logs available for ingestion into Elastic, enabling threat detection within SIEM/XDR solutions. Previously, this critical telemetry was largely inaccessible to customers, leaving a significant visibility gap for defenders. This development allows for the monitoring of adversary activities that leverage the legacy graph.windows.net surface, which remained unlogged until recently.