Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws

In the present day is Microsoft’s June 2025 Patch Tuesday, which incorporates security updates for 66 flaws, together with one actively exploited vulnerability and one other that was publicly disclosed.

This Patch Tuesday additionally fixes ten “Vital” vulnerabilities, eight being distant code execution vulnerabilities and two being elevation of privileges bugs.

The variety of bugs in every vulnerability class is listed under:

• 13 Elevation of Privilege Vulnerabilities
• 3 Safety Characteristic Bypass Vulnerabilities
• 25 Distant Code Execution Vulnerabilities
• 17 Info Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

This rely doesn’t embody Mariner, Microsoft Edge, and Energy Automate flaws mounted earlier this month.

To study extra concerning the non-security updates launched right now, you may evaluate our devoted articles on the Home windows 11 KB5060842 and KB5060999 cumulative updates and the Home windows 10 KB5060533 cumulative replace.

Two zero-days

This month’s Patch Tuesday fixes one actively exploited zero-day and one publicly disclosed vulnerability. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited whereas no official repair is out there.

The actively exploited zero-day vulnerability in right now’s updates is:

CVE-2025-33053 – Internet Distributed Authoring and Versioning (WEBDAV) Distant Code Execution Vulnerability

Microsoft mounted a distant code execution vulnerability found by Verify Level Analysis

“A distant code execution vulnerability exists in Microsoft Home windows Internet Distributed Authoring and Versioning. Profitable exploitation of this vulnerability might permit a distant attacker to execute arbitrary code on the affected system,” reads a Verify Level Analysis advisory.

Microsoft’s advisory additional states {that a} consumer should click on on a specifically crafted WebDav URL for the flaw to be exploited.

Whereas Microsoft says that the vulnerability has been exploited in assaults, no additional particulars have been shared. BleepingComputer contacted Verify Level to study extra about how the flaw was utilized in assaults.

Microsoft attributes the invention of this flaw to Alexandra Gofman and David Driker (Verify Level Analysis).

The publicly disclosed zero-day is:

CVE-2025-33073 – Home windows SMB Consumer Elevation of Privilege Vulnerability

Microsoft fixes a flaw in Home windows SMB that permits attackers to achieve SYSTEM privileges on susceptible units.

“Improper entry management in Home windows SMB permits a licensed attacker to raise privileges over a community,” explains Microsoft.

“To use this vulnerability, an attacker might execute a specifically crafted malicious script to coerce the sufferer machine to attach again to the assault system utilizing SMB and authenticate. This might lead to elevation of privilege,” additional explains Microsoft.

Microsoft has not shared how the flaw was publicly disclosed. Nonetheless, Born Metropolis studies that DFN-CERT (Pc Emergency Response Crew of the German Analysis Community) started circulating warnings from RedTeam Pentesting concerning the flaw this week.

Whereas an replace is now accessible, the flaw can reportedly be mitigated by implementing server-side SMB signing by way of Group Coverage.

Microsoft attributes the invention of this flaw to a number of researchers, together with Keisuke Hirata with CrowdStrike, Synacktiv analysis with Synacktiv, Stefan Walter with SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw of Google Undertaking Zero.

Latest updates from different corporations

Different distributors who launched updates or advisories in June 2025 embody:

• Adobe launched security updates for InCopy, Expertise Supervisor, Commerce, InDesign, Substance 3D Sampler, Acrobat Reader, and Substance 3D Painter.
• Cisco launched patches for 3 vulnerabilities with public exploit code in its Id Providers Engine (ISE) and Buyer Collaboration Platform (CCP) merchandise.
• Fortinet launched security updates for an OS command (‘OS Command Injection’) vulnerability in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData merchandise.
• Google’s June 2025 security updates for Android repair quite a few vulnerabilities. Google additionally mounted an actively exploited Google Chrome zero-day flaw.
• Hewlett Packard Enterprise (HPE) issued security updates to repair eight vulnerabilities impacting StoreOnce,
• Ivanti launched security updates to repair three high-severity hardcoded key vulnerabilities in Workspace Management (IWC).
• Qualcomm launched security updates for 3 zero-day vulnerabilities within the Adreno Graphics Processing Unit (GPU) driver which might be exploited in focused assaults.
• Roundcube launched security updates for a essential distant code execution (RCE) flaw with a public exploit that’s now exploited in assaults.
• SAP releases security updates for a number of merchandise, together with a essential lacking authorization verify in SAP NetWeaver Software Server for ABAP.

The June 2025 Patch Tuesday Safety Updates

Under is the entire listing of resolved vulnerabilities within the June 2025 Patch Tuesday updates.

To entry the total description of every vulnerability and the techniques it impacts, you may view the full report right here.