Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws

Right now is Microsoft’s June 2025 Patch Tuesday, which incorporates safety updates for 66 flaws, together with one actively exploited vulnerability and one other that was publicly disclosed.

This Patch Tuesday additionally fixes ten “Essential” vulnerabilities, eight being distant code execution vulnerabilities and two being elevation of privileges bugs.

The variety of bugs in every vulnerability class is listed under:

• 13 Elevation of Privilege Vulnerabilities
• 3 Safety Characteristic Bypass Vulnerabilities
• 25 Distant Code Execution Vulnerabilities
• 17 Data Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

This depend doesn’t embrace Mariner, Microsoft Edge, and Energy Automate flaws mounted earlier this month.

To be taught extra in regards to the non-security updates launched at present, you possibly can overview our devoted articles on the Home windows 11 KB5060842 and KB5060999 cumulative updates and the Home windows 10 KB5060533 cumulative replace.

Two zero-days

This month’s Patch Tuesday fixes one actively exploited zero-day and one publicly disclosed vulnerability. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is accessible.

The actively exploited zero-day vulnerability in at present’s updates is:

CVE-2025-33053 – Internet Distributed Authoring and Versioning (WEBDAV) Distant Code Execution Vulnerability

Microsoft mounted a distant code execution vulnerability found by Test Level Analysis

“A distant code execution vulnerability exists in Microsoft Home windows Internet Distributed Authoring and Versioning. Profitable exploitation of this vulnerability might enable a distant attacker to execute arbitrary code on the affected system,” reads a Test Level Analysis advisory.

Microsoft’s advisory additional states {that a} consumer should click on on a specifically crafted WebDav URL for the flaw to be exploited.

A brand new report by Test Level Analysis explains that CVE-2025-33053 was exploited in zero-day assaults by an APT group named “Stealth Falcon”.

“In March 2025, Test Level Analysis recognized an tried cyberattack in opposition to a protection firm in Turkey,” defined Test Level.

“The risk actors used a beforehand undisclosed approach to execute recordsdata hosted on a WebDAV server they managed, by manipulating the working listing of a official built-in Home windows software.”

“Following accountable disclosure, Microsoft assigned the vulnerability CVE-2025-33053 and launched a patch on June 10, 2025, as a part of their June Patch Tuesday updates.”

Microsoft attributes the invention of this flaw to Alexandra Gofman and David Driker (Test Level Analysis).

The publicly disclosed zero-day is:

CVE-2025-33073 – Home windows SMB Consumer Elevation of Privilege Vulnerability

Microsoft fixes a flaw in Home windows SMB that enables attackers to achieve SYSTEM privileges on weak units.

“Improper entry management in Home windows SMB permits a licensed attacker to raise privileges over a community,” explains Microsoft.

“To use this vulnerability, an attacker might execute a specifically crafted malicious script to coerce the sufferer machine to attach again to the assault system utilizing SMB and authenticate. This might end in elevation of privilege,” additional explains Microsoft.

Microsoft has not shared how the flaw was publicly disclosed. Nonetheless, Born Metropolis reviews that DFN-CERT (Laptop Emergency Response Group of the German Analysis Community) started circulating warnings from RedTeam Pentesting in regards to the flaw this week.

Whereas an replace is now out there, the flaw can reportedly be mitigated by imposing server-side SMB signing through Group Coverage.

Microsoft attributes the invention of this flaw to a number of researchers, together with Keisuke Hirata with CrowdStrike, Synacktiv analysis with Synacktiv, Stefan Walter with SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw of Google Challenge Zero.

Current updates from different corporations

Different distributors who launched updates or advisories in June 2025 embrace:

• Adobe launched safety updates for InCopy, Expertise Supervisor, Commerce, InDesign, Substance 3D Sampler, Acrobat Reader, and Substance 3D Painter.
• Cisco launched patches for 3 vulnerabilities with public exploit code in its Id Companies Engine (ISE) and Buyer Collaboration Platform (CCP) merchandise.
• Fortinet launched safety updates for an OS command (‘OS Command Injection’) vulnerability in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData merchandise.
• Google’s June 2025 safety updates for Android repair quite a few vulnerabilities. Google additionally mounted an actively exploited Google Chrome zero-day flaw.
• Hewlett Packard Enterprise (HPE) issued safety updates to repair eight vulnerabilities impacting StoreOnce,
• Ivanti launched safety updates to repair three high-severity hardcoded key vulnerabilities in Workspace Management (IWC).
• Qualcomm launched safety updates for 3 zero-day vulnerabilities within the Adreno Graphics Processing Unit (GPU) driver which might be exploited in focused assaults.
• Roundcube launched safety updates for a crucial distant code execution (RCE) flaw with a public exploit that’s now exploited in assaults.
• SAP releases safety updates for a number of merchandise, together with a crucial lacking authorization test in SAP NetWeaver Software Server for ABAP.

The June 2025 Patch Tuesday Safety Updates

Beneath is the whole record of resolved vulnerabilities within the June 2025 Patch Tuesday updates.

To entry the complete description of every vulnerability and the programs it impacts, you possibly can view the full report right here.

Patching used to imply complicated scripts, lengthy hours, and infinite hearth drills. Not anymore.

On this new information, Tines breaks down how fashionable IT orgs are leveling up with automation. Patch quicker, cut back overhead, and give attention to strategic work — no complicated scripts required.

Get the free information