The Center for Internet Security is urging organizations to patch a batch of Microsoft vulnerabilities right away, warning that one has already been exploited by hackers.
Microsoft has released security updates fixing multiple vulnerabilities across its products, and the Center for Internet Security says one of them is already being used in real-world attacks.
According to the Center for Internet Security, the flaws affect widely used Microsoft products including Windows, Office, Exchange Server, SharePoint Server, SQL Server, Azure, and Defender. The most serious of the vulnerabilities could allow an attacker to run malicious code remotely, meaning they could break in without needing physical access to a device.
The Center for Internet Security reports that one specific flaw, tracked as CVE-2026-124194, has already been exploited in the wild, according to Microsoft.
If successfully exploited, an attacker could gain the same level of access as whoever is logged into the affected computer. That means they could potentially install software, view or alter files, delete data, or even create new user accounts with full control of the system. People whose accounts have limited permissions, rather than full administrator access, would likely see less damage if targeted.
The Center for Internet Security rates the risk as high for large and medium-sized businesses and government offices, medium for small businesses and small government entities, and low for home users.
This matters because many of the affected products, like Exchange Server and SharePoint, are commonly used by workplaces and organizations to handle email, documents, and shared data. A single unpatched system could give an attacker a foothold into a larger network.
The Center for Internet Security recommends applying Microsoft’s updates to vulnerable systems as soon as possible, after appropriate testing. The agency also advises limiting user accounts to only the access they need, since accounts without administrator-level privileges are less likely to suffer serious damage if compromised.
Based on a release from Center for Internet Security.