Fixes For Actively Exploited Flaws
Microsoft has released security updates for Windows and Office to address vulnerabilities that the company said are being actively abused by hackers to break into computers. The attacks are described as one-click exploits, which means a victim can be compromised with minimal interaction. At least two of the flaws can be triggered when a user clicks a malicious link in Windows, and another can lead to a takeover when a malicious Office file is opened. Microsoft said the issues are zero-days, meaning attackers were using them before fixes were available. The company also said details on how to exploit the bugs have been published, which could increase the risk of attacks, though it did not say where those details appeared. A Microsoft spokesperson did not immediately comment when TechCrunch asked about the disclosure.
Windows Shell Bug And SmartScreen Bypass
One of the vulnerabilities, tracked as CVE-2026-21510, is in the Windows shell, which runs the operating system’s user interface and affects all supported versions of Windows, according to Microsoft. When a victim clicks a malicious link, the flaw allows an attacker to bypass Microsoft’s SmartScreen feature, which is meant to screen links and files for malware. Security expert Dustin Childs said the bug can be used to plant malware remotely. “There is user interaction here, as the client needs to click a link or a shortcut file,” Childs wrote in a blog post. “Still, a one-click bug to gain code execution is a rarity.” A Google spokesperson said the Windows shell flaw was under “widespread, active exploitation” and said successful attacks enabled silent malware execution with high privileges, which “poses a high risk of subsequent system compromise, deployment of ransomware, or intelligence collection.”
MSHTML Bug And Other Attack Paths
Microsoft also fixed another Windows issue, tracked as CVE-2026-21513, that was found in MSHTML, the company’s proprietary browser engine that powered Internet Explorer and remains in Windows for compatibility with older applications. Microsoft said this flaw can be used to bypass Windows security features to plant malware. The company said other attack paths include luring a victim into opening a malicious Office file, which can also result in a compromise.
Discovery And Disclosure Context
In its advisories, Microsoft credited security researchers from Google’s Threat Intelligence Group for their role in identifying the vulnerabilities. The company said the publication of exploit details raises the likelihood of attacks, and it urged users to apply the updates.
Featured image credits: Flickr
For more stories like it, click the +Follow button at the top of this page to follow us.