Windows Server 2025

CrowdStrike is investigating FalconFlank, a public proof-of-concept that allegedly enables local privilege escalation through Falcon Sensor’s Microsoft Office malicious-macro remediation workflow. Until the investigation is complete, the company recommends disabling the “Microsoft Office File Suspicious Macro Removal” Windows policy setting on affected Windows 11 25H2 and Windows Server 2025 systems.

CISA has confirmed that ransomware gangs are exploiting CVE-2025-60710, a Windows Task Host privilege-escalation flaw affecting Windows 11 and Windows Server 2025. Microsoft patched the vulnerability in November 2025, but CISA has not disclosed which ransomware operations or attacks are using it.

Microsoft has assigned CVE-2026-69414 to the ShieldBreak Microsoft Defender privilege-escalation zero-day and says it is developing a security update. The flaw, which bypassed Microsoft's RoguePlanet fix, allows a local attacker with limited permissions to reach SYSTEM privileges on affected Windows systems.

A new ShieldBreak proof of concept claims to bypass Microsoft’s fix for the RoguePlanet vulnerability in Microsoft Defender, restoring a path to SYSTEM-level privileges. Testing reportedly succeeded on fully updated Windows 11 25H2 and Windows Server 2025 systems, while Windows 10 is also considered vulnerable.