Vulnerabilities · 169 days ago

Federal Systems Still Exposed to Decade-Old Microsoft Vulnerabilities

Attackers are exploiting Microsoft vulnerabilities, including one patched nearly 14 years ago, showing that federal systems may still run legacy or unpatched software. This reuse of old flaws reveals gaps in patch management that standard responses often overlook.

CISA added four Microsoft vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them within two weeks. These include recent privilege escalation and remote code execution flaws in Windows and Exchange Server, plus a 2012 Visual Basic for Applications vulnerability still actively exploited.

The persistence of attacks leveraging a 2012 vulnerability signals that legacy software remains a critical risk. This trend suggests that patching alone is insufficient if older systems or updates are neglected, leaving federal networks vulnerable to ransomware and data theft.

Timeline

• Apr 27 CISA federal deadline for CVE-2023-21529
• Apr 13 Reported by The Register Security

Sources

1 source covering this story

• The Register Security Apr 13

  Ransomware scum, other crims exploit 4 old Microsoft bugs

  : One was patched almost 14 years ago

Entities

• CVE-2025-60710
• CVE-2023-36424
• CVE-2023-21529
• CVE-2012-1854

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-04-14

Editions

• Briefing for 2026-04-14

Related stories

• Malicious PDFs Enable Code Execution Across Windows and macOS
• Adobe Reader Zero-Day Uses Stealthy Fingerprinting Before RCE