Microsoft on Tuesday rolled out fixes for a large set of 111 security flaws throughout its software program portfolio, together with one flaw that has been disclosed as publicly recognized on the time of the discharge.
Of the 111 vulnerabilities, 16 are rated Vital, 92 are rated Necessary, two are rated Average, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, adopted by distant code execution (35), info disclosure (18), spoofing (8), and denial-of-service (4) defects.
That is along with 16 vulnerabilities addressed in Microsoft’s Chromium-based Edge browser because the launch of final month’s Patch Tuesday replace, together with two spoofing bugs affecting Edge for Android.
Included among the many vulnerabilities is a privilege escalation vulnerability impacting Microsoft Change Server hybrid deployments (CVE-2025-53786, CVSS rating: 8.0) that Microsoft disclosed final week.
The publicly disclosed zero-day is CVE-2025-53779 (CVSS rating: 7.2), one other privilege escalation flaw in Home windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug.
It is price mentioning right here that the difficulty was publicly detailed again in Might 2025 by the net infrastructure and security firm, giving it the codename BadSuccessor. The novel approach basically permits a menace actor with ample privileges to compromise an Energetic Listing (AD) area by misusing delegated Managed Service Account (dMSA) objects.
“The excellent news right here is that profitable exploitation of CVE-2025-53779 requires an attacker to have pre-existing management of two attributes of the hopefully properly protected dMSA: msds-groupMSAMembership, which determines which customers might use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which accommodates a listing of customers on whose behalf the dMSA can act,” Adam Barnett, lead software program engineer at Rapid7, informed The Hacker Information.
“Nevertheless, abuse of CVE-2025-53779 is actually believable as the ultimate hyperlink of a multi-exploit chain which stretches from no entry to whole pwnage.”
Action1’s Mike Walters famous that the trail traversal flaw could be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a site administrator, and doubtlessly achieve full management of the Energetic Listing area.
“An attacker who already has a compromised privileged account can use it to maneuver from restricted administrative rights to full area management,” Walters added. “It may also be paired with strategies equivalent to Kerberoasting or Silver Ticket assaults to take care of persistence.”
“With area administrator privileges, attackers can disable security monitoring, modify Group Coverage, and tamper with audit logs to cover their exercise. In multi-forest environments or organizations with accomplice connections, this flaw may even be leveraged to maneuver from one compromised area to others in a provide chain assault.”
Satnam Narang, senior employees analysis engineer at Tenable, stated the fast affect of BadSuccessor is restricted, as solely 0.7% of Energetic Listing domains had met the prerequisite on the time of disclosure. “To take advantage of BadSuccessor, an attacker should have no less than one area controller in a site operating Home windows Server 2025 with the intention to obtain area compromise,” Narang identified.
A few of notable Vital-rated vulnerabilities patched by Redmond this month are beneath –
- CVE-2025-53767 (CVSS rating: 10.0) – Azure OpenAI Elevation of Privilege Vulnerability
- CVE-2025-53766 (CVSS rating: 9.8) – GDI+ Distant Code Execution Vulnerability
- CVE-2025-50165 (CVSS rating: 9.8) – Home windows Graphics Part Distant Code Execution Vulnerability
- CVE-2025-53792 (CVSS rating: 9.1) – Azure Portal Elevation of Privilege Vulnerability
- CVE-2025-53787 (CVSS rating: 8.2) – Microsoft 365 Copilot BizChat Info Disclosure Vulnerability
- CVE-2025-50177 (CVSS rating: 8.1) – Microsoft Message Queuing (MSMQ) Distant Code Execution Vulnerability
- CVE-2025-50176 (CVSS rating: 7.8) – DirectX Graphics Kernel Distant Code Execution Vulnerability
Microsoft famous that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no buyer motion.
Test Level, which disclosed CVE-2025-53766 alongside CVE-2025-30388, stated the vulnerabilities enable attackers to execute arbitrary code on the affected system, resulting in a full system compromise.
“The assault vector includes interacting with a specifically crafted file. When a person opens or processes this file, the vulnerability is triggered, permitting the attacker to take management,” the cybersecurity firm stated.
The Israeli agency revealed that it additionally uncovered a vulnerability in a Rust-based part of the Home windows kernel that can lead to a system crash that, in flip, triggers a tough reboot.
“For organizations with giant or distant workforces, the danger is important: attackers may exploit this flaw to concurrently crash quite a few computer systems throughout an enterprise, leading to widespread disruption and expensive downtime,” Test Level stated. “This discovery highlights that even with superior security applied sciences like Rust, steady vigilance and proactive patching are important to sustaining system integrity in a posh software program atmosphere.”
One other vulnerability of significance is CVE-2025-50154 (CVSS rating: 6.5), an NTLM hash disclosure spoofing vulnerability that is truly a bypass for the same bug (CVE-2025-24054, CVSS rating: 6.5) that was plugged by Microsoft in March 2025.
“The unique vulnerability demonstrated how specifically crafted requests may set off NTLM authentication and expose delicate credentials,” Cymulate researcher Ruben Enkaoua stated. “This new vulnerability […] permits an attacker to extract NTLM hashes with none person interplay, even on absolutely patched techniques. By exploiting a delicate hole left within the mitigation, an attacker can set off NTLM authentication requests routinely, enabling offline cracking or relay assaults to achieve unauthorized entry.”
