Sysmon
The latest Sysmon coverage — news, analysis, and updates from the WindowsNews.AI desk.
Windows Defender Firewall Type Confusion Bug Opens Door to SYSTEM-Level Compromise
A severe type confusion vulnerability in the Windows Defender Firewall service, tracked as CVE-2025-54109, could allow an attacker with a low-privilege local account to seize complete SYSTEM control...
Microsoft Issues Urgent Fix for Windows Defender Firewall Type-Confusion EoP (CVE-2025-54104)
Microsoft has confirmed a critical elevation-of-privilege vulnerability in the Windows Defender Firewall Service (MpsSvc) that could enable an attacker with local access to escalate to SYSTEM-level...
GE Vernova Issues Urgent Patch for CIMPLICITY DLL Hijacking Flaw Rated CVSS 7.0
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory detailing a dangerous privilege escalation vulnerability in GE Vernova’s CIMPLICITY HMI/SCADA platform....
PC Manager’s 7.8 CVSS Flaw Exposed: How Symlinks Give Attackers SYSTEM Rights
A vulnerability tracked as CVE-2025-29975 in Microsoft PC Manager hands local attackers a direct path to full SYSTEM control. With a CVSS 3.1 score of 7.8 (high) and a low attack complexity, the bug...
Rockwell FactoryTalk ViewPoint Flaw Lets Attackers Hijack MSI Repairs for SYSTEM Access
A critical privilege escalation vulnerability in Rockwell Automation’s FactoryTalk ViewPoint HMI thin-client software allows a low-privileged local attacker to gain SYSTEM-level control of...
Rockwell Patch Plugs SYSTEM Takeover Hole in FactoryTalk ViewPoint via MSI Repair Hijack
A high-severity local privilege-escalation vulnerability in Rockwell Automation’s FactoryTalk ViewPoint HMI software can hand an attacker full SYSTEM control of a Windows machine by exploiting a...
Siemens Flags CVSS 8.5 DLL Hijacking in Web Installer, Urges Immediate Mitigation for ICS Products
Siemens has confirmed a severe vulnerability in its Web Installer used by the Online Software Delivery (OSD) mechanism, allowing attackers to hijack the installation process and execute arbitrary...
Microsoft’s June Patch Fixes Storport Driver Flaw That Could Expose Kernel Memory and Defeat ASLR
Microsoft’s June 2025 Patch Tuesday quietly resolved a local information-disclosure vulnerability in the Windows Storage Port Driver (storport.sys) that could allow authenticated attackers to read...
Patch Now: Critical Windows PrintWorkflowUserSvc Flaws Allow Attackers to Gain SYSTEM Privileges
Microsoft's December 2024 Patch Tuesday included a fix for CVE-2024-49095, a high-severity elevation of privilege vulnerability in the Windows PrintWorkflowUserSvc service that could give attackers...
Detecting and Removing Legacy VBScript Dependencies in Windows 11: A Comprehensive Guide
Introduction Visual Basic Scripting Edition (VBScript) has been a cornerstone in Windows environments since its introduction in 1996, facilitating automation tasks and enhancing web functionalities....