Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum
One was patched almost 14 years ago
Crooks are exploiting four Microsoft vulnerabilities - one patched 14 years ago and another tied to ransomware activity - according to America's lead cyber-defense agency, which on Monday gave federal agencies two weeks to patch them.
The four vulnerabilities added to CISA's Known Exploited Vulnerabilities (KEV) catalog on Monday are:
CVE-2025-60710, a link-following vulnerability in Windows that allows privilege escalation. After initially disclosing this bug in November 2025, Redmond fully fixed it a month later.
CVE-2023-36424, a Windows Common Log File System Driver flaw that allows privilege escalation. Microsoft patched this one in November 2023.
CVE-2023-21529, a deserialization of untrusted data issue in Microsoft Exchange Server that allows an authenticated attacker to achieve remote code execution (RCE). Redmond disclosed and patched the bug in February 2023. Just last week, Microsoft's threat hunters warned that a financially motivated crime crew tracked as Storm-1175 is exploiting this Exchange bug, plus 15 others, to gain initial access to organizations before ultimately stealing their data and deploying Medusa ransomware in extortion attacks.
CVE-2012-1854, an insecure library loading vulnerability in Microsoft Visual Basic for Applications that allows RCE. Microsoft pushed a security fix for this one in July 2012, and then a second software update in November 2012 that fully patched the flaw. At the time, Redmond said it was "aware of limited, targeted attacks attempting to exploit the vulnerability." This means a flaw first exploited almost 14 years ago is still turning up in active attacks today.
We've reached out to Microsoft for more details about the scope of exploitation, and who is attacking these four CVEs, and will update this story if we receive any response to our inquiries.
CISA lists ransomware use for all four as "unknown," although according to Redmond, at least one of them (CVE-2023-21529) has been abused for this type of attack.
"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned in adding the bugs to its catalog, and set an April 27 deadline for all federal agencies to apply patches.
Also on Monday, CISA added two Adobe bugs, a use-after-free vuln in Acrobat tracked as CVE-2020-9715, and a prototype pollution flaw tracked as CVE-2026-34621 that affected both Adobe Acrobat and Reader, to the KEV. The latter had been exploited as a zero-day for months, and Adobe finally released a patch over the weekend. ®