Agent 365 Security
The latest Agent 365 Security coverage — news, analysis, and updates from the WindowsNews.AI desk.
Office 365 Apps Version 2508 Breaks Legacy Web Folders: Block FrontPage RPC by Default
Microsoft 365 Apps version 2508 now blocks the legacy FrontPage RPC protocol by default, breaking file access for WebDAV and older SharePoint paths. Users can restore access by adding sources to Office Trusted Locations or by disabling the block through Group Policy. The move significantly reduces the attack surface, forcing organizations to modernize their document workflows.
ConsentFix and ClickFix: The New Phishing Kits Hijacking Microsoft 365 via Familiar Prompts
ConsentFix and ClickFix are two emerging attack techniques that hijack Microsoft 365 accounts by exploiting trusted OAuth consent flows and Windows prompts. ConsentFix tricks users into granting malicious apps access to their data, while ClickFix deceives them into executing harmful commands, often bypassing MFA and endpoint defenses. These attacks reveal critical security gaps in user consent models and endpoint management, requiring organizations to tighten permissions, restrict command execution, and rethink security awareness training.
Windows 10 Security Patches Extended Until 2027, But Cloud Registration Now Required
Microsoft has extended the Windows 10 Extended Security Updates program for consumers until October 12, 2027, giving users an additional year of critical patches. The extension reportedly comes with requirements for Microsoft account enrollment and deeper cloud service integration, aligning with Microsoft’s push to migrate users to Windows 11 and its ecosystem.
Microsoft’s UEFI Secure Boot Certificate Will Expire in 2026—Here’s What Windows Users Must Do Now
The Microsoft UEFI CA 2011 certificate, which underpins Secure Boot on millions of PCs, expires on October 19, 2026. Without the new 2023 certificate, systems may fail to boot. Users must install Windows and firmware updates now to avoid a sudden failure, and enterprise admins should audit their fleets immediately.
CVE-2026-53357: Linux Bluetooth L2CAP Race Puts Windows Mixed Environments at Risk
CVE-2026-53357 is a use-after-free race condition in the Linux kernel's Bluetooth L2CAP implementation that can lead to denial of service or code execution. Although the flaw resides in Linux, Windows environments that run Linux VMs, use WSL with Bluetooth passthrough, or dual-boot are indirectly exposed. The article explains the vulnerability, its cross-platform implications, and provides mitigation steps for Windows administrators managing mixed fleets.
ksmbd Auth Bypass CVE-2026-52944 Exposes Linux SMB Shares to Sparse File Manipulation
CVE-2026-52944 exposes a critical flaw in the Linux kernel’s ksmbd SMB server that lets authenticated users alter sparse file attributes without proper permission checks. The vulnerability can lead to file corruption, storage misreporting, and denial-of-service attacks in mixed Windows-Linux environments. Administrators should immediately audit ksmbd deployments, apply kernel updates, or switch to alternative SMB servers until patches are available.
CVE-2026-53016: Linux CCP Crypto Driver IV Overrun Vulnerability Underscores Cryptographic Risks for All OS Users
CVE-2026-53016 is a buffer overrun vulnerability in the Linux kernel's AMD CCP crypto driver that incorrectly copies a 16-byte IV into an 8-byte buffer during AF_ALG CTR-AES operations. The flaw could lead to memory corruption and potential privilege escalation on affected AMD-based Linux systems. Although Windows uses a different cryptographic architecture, the incident serves as a critical reminder to harden kernel-mode crypto drivers against similar size-mismatch errors.
Linux OMFS Kernel Bug CVE-2026-53130: How a Mount-Time Underflow Threatens WSL and Windows Security
CVE-2026-53130 is a high-severity Linux kernel bug in the OMFS driver that allows an out-of-bounds overwrite via a mount-time integer underflow. Because WSL 2 uses a real Linux kernel, Windows users are exposed until they update. The article explains the vulnerability, demonstrates an attack scenario, and provides step-by-step mitigation advice.
CVE-2026-52992: Critical ADFS Driver Bug Opens Linux to Out-of-Bounds Memory Attacks
CVE-2026-52992 is a critical out-of-bounds write vulnerability in the Linux kernel's ADFS filesystem driver, disclosed on June 24, 2026. Attackers can exploit it by mounting a malicious disk image, potentially leading to memory corruption and code execution. The flaw affects all systems with the ADFS driver enabled, including Windows Subsystem for Linux (WSL) instances, and patches are being rolled out.
CVE-2026-53098: Urgent Linux Kernel Patch Plugs Use-After-Free Hole in MediaTek Wi-Fi Driver
A use-after-free race condition in the Linux kernel’s MediaTek mt76 mt7915 Wi-Fi driver, tracked as CVE-2026-53098, has been patched after its June 24, 2026 disclosure. The flaw could allow local privilege escalation or denial of service and affects a wide range of routers and embedded devices. Windows users are not directly impacted but should audit their network gear for vulnerable Linux-based firmware.
Critical Linux USB Driver Flaw CVE-2026-53195 Strikes Mixed Windows-Linux Fleets via WSL
CVE-2026-53195 is a heap overflow in the Linux kernel's io_ti USB serial driver that can be triggered by a malicious USB device. The flaw directly impacts Windows environments through WSL2, Hyper‑V Linux VMs, and dual‑boot machines. Administrators must patch WSL2 kernels via Windows Update, blacklist the vulnerable driver, and tighten USB access controls across mixed Windows‑Linux fleets.
Microsoft Alerted Users of a Linux Tegra124 Kernel Flaw—Here’s Why CVE-2026-53045 Matters for Windows
CVE-2026-53045 is a Linux kernel flaw in the NVIDIA Tegra124 EMC driver that caused Microsoft to issue a security advisory due to its impact on WSL2 and Azure workloads. The vulnerability, a reversed bit check, can lead to crashes and potential escalation in Linux environments that integrate with Windows. Enterprises are urged to update WSL kernels and Azure container images to mitigate risks from cross-platform dependency.
CVE-2026-53049: GFS2 Race Condition Forces Linux Kernel Patch—Windows Admins Must Act
A race condition in the Linux kernel's GFS2 filesystem, CVE-2026-53049, can corrupt data or crash systems. Windows admins running WSL2, Azure VMs, or containers must patch their Linux kernels immediately and consider blacklisting the GFS2 module where it's not needed.