Microsoft November 2025 Patch Tuesday fixes 1 zero-day, 63 flaws

At this time is Microsoft’s November 2025 Patch Tuesday, which incorporates security updates for 63 flaws, together with one actively exploited zero-day vulnerability.

This Patch Tuesday additionally addresses 4 “Essential” vulnerabilities, two of that are distant code execution vulnerabilities, one is an elevation of privileges, and the fourth is an info disclosure flaw.

The variety of bugs in every vulnerability class is listed under:

• 29 Elevation of Privilege Vulnerabilities
• 2 Safety Function Bypass Vulnerabilities
• 16 Distant Code Execution Vulnerabilities
• 11 Info Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

When BleepingComputer experiences on the Patch Tuesday security updates, we solely depend these launched at this time by Microsoft. Due to this fact, the variety of flaws doesn’t embrace Microsoft Edge and Mariner vulnerabilities mounted earlier this month.

At this time can also be the primary prolonged security replace (ESU) for Home windows 10, so if you’re nonetheless using the unsupported working system, it’s strongly suggested that you simply improve to Home windows 11 or enroll within the ESU program.

For individuals who are having points enrolling in this system, Microsoft launched an out-of-band replace at this time to repair an bug that stops enrollments.

To study extra in regards to the non-security updates launched at this time, you’ll be able to assessment our devoted articles on the Home windows 11 KB5066835 and KB5066793 updates and the Home windows 10 KB5068781 prolonged security replace.

When you’re dealing with delays, blind spots, or prioritization points with Patch Tuesday updates, be a part of our December 2 webinar with Action1 to find out how trendy patch administration helps you patch sooner and scale back threat.

1 actively exploited zero-day

This month’s Patch Tuesday fixes one actively exploited zero-day flaw within the Home windows Kernel.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is on the market.

The exploited zero-days is:

CVE-2025-62215 – Home windows Kernel Elevation of Privilege Vulnerability

Microsoft has patched a Home windows Kernel flaw that was exploited to realize SYSTEM privilges on Home windows units.

“Concurrent execution utilizing shared useful resource with improper synchronization (‘race situation’) in Home windows Kernel permits a licensed attacker to raise privileges domestically,” explains Microsoft.

Microsoft says that the flaw requires an attackers to win a race situation, upon which they obtain SYSTEM privileges.

Microsoft has attributed the flaw to Microsoft Menace Intelligence Middle (MSTIC) & Microsoft Safety Response Middle (MSRC)  however has not shared how the flaw was exploited.

Latest updates from different firms

Different distributors who launched updates or advisories in November 2025 embrace:

• Adobe launched security updates for InDesign, InCopy, PhotoShop, Illustrator, Substance 3D, Move, and Adobe Format.
• Cisco launched patches for a number of merchandise, together with Cisco ASA, Unified Contact Middle, and Identification providers. Cisco additionally warned this month {that a} new assault was found exploiting older flaws.
• expr-eval builders launched patches to repair a crucial RCE within the JavaScript library.
• Fortinet launched a security replace for a medium-severity elevation of privileges flaw in FortiOS.
• Google has launched the Android’s November security bulletin with fixes for 2 vulnerabilities.
• Ivanti launched security patches as a part of its November 2025 Patch Tuesday updates.
• runC security updates repair flaws permitting attackers to flee Docker and Kubernetes containers.
• QNAP launched security updates for seven zero-day vulnerabilities exploited to hack network-attached storage (NAS) units through the Pwn2Own Eire 2025 hacking contest.
• SAP launched the November security updates for a number of merchandise, together with a repair for a ten/10 harcoded credentials flaw in SQL Anyplace Monitor.
• Samsung launched its November security updates with fixes for 25 flaws.

The November 2025 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the November 2025 Patch Tuesday updates.

To entry the total description of every vulnerability and the methods it impacts, you’ll be able to view the full report right here.