Microsoft has launched patches to repair 67 security flaws, together with one zero-day bug in Internet Distributed Authoring and Versioning (WEBDAV) that it mentioned has come below lively exploitation within the wild.
Of the 67 vulnerabilities, 11 are rated Important and 56 are rated Vital in severity. This contains 26 distant code execution flaws, 17 info disclosure flaws, and 14 privilege escalation flaws.
The patches are along with 13 shortcomings addressed by the corporate in its Chromium-based Edge browser because the launch of final month’s Patch Tuesday replace.
The vulnerability that has been weaponized in real-world assaults issues a distant code execution in WEBDAV (CVE-2025-33053, CVSS rating: 8.8) that may be triggered by deceiving customers into clicking on a specifically crafted URL.
The tech large credited Examine Level researchers Alexandra Gofman and David Driker for locating and reporting the bug. It is price mentioning that CVE-2025-33053 is the primary zero-day vulnerability to be disclosed within the WebDAV normal.
In a separate report, the cybersecurity firm attributed the abuse of CVE-2025-33053 to a risk actor generally known as Stealth Falcon (aka FruityArmor), which has a historical past of leveraging Home windows zero-days in its assaults. In September 2023, the hacking group was noticed utilizing a backdoor dubbed Deadglyph as a part of an espionage marketing campaign aimed toward entities in Qatar and Saudi Arabia.
“The assault used a .url file that exploited a zero-day vulnerability (CVE-2025-33053) to execute malware from an actor-controlled WebDAV server,” Examine Level mentioned. “CVE-2025-33053 permits distant code execution by way of manipulation of the working listing.”
Within the assault chain noticed towards an unnamed protection firm in Turkey, the risk actor is alleged to have employed CVE-2025-33053 to ship Horus Agent, a {custom} implant constructed for the Mythic command-and-control (C2) framework. It is believed that the malicious payload used to provoke the assault, a URL shortcut file, was despatched as an archived attachment in a phishing electronic mail.
The URL file is used to launch iediagcmd.exe, a professional diagnostics utility for Web Explorer, leveraging it to launch one other payload referred to as Horus Loader, which is chargeable for serving a decoy PDF doc and executing Horus Agent.
“Written in C++, the implant reveals no important overlap with recognized C-based Mythic brokers, except for commonalities within the generic logic associated to Mythic C2 communications,” Examine Level mentioned. “Whereas the loader makes certain to implement some measures to guard the payload, the risk actors positioned extra precautions inside the backdoor itself.”
This contains the usage of methods like string encryption and management circulation flattening to complicate evaluation efforts. The backdoor then connects to a distant server to fetch duties that permit it to gather system info, enumerate information and folders, obtain information from the server, inject shellcode into operating processes, and exit this system.
 |
| CVE-2025-33053 an infection chain |
Horus Agent is assessed to be an evolution of the custom-made Apollo implant, an open-source .NET agent for Mythic framework, that was beforehand put to make use of by Stealth Falcon between 2022 and 2023.
“Horus is a extra superior model of the risk teams’ {custom} Apollo implant, rewritten in C++, improved, and refactored,” Examine Level mentioned.
“Much like the Horus model, the Apollo model introduces intensive sufferer fingerprinting capabilities whereas limiting the variety of supported instructions. This enables the risk actors to give attention to stealthy identification of the contaminated machine and subsequent stage payload supply, whereas additionally retaining the implant dimension considerably smaller (solely 120Kb) than the total agent.”
The corporate mentioned it additionally noticed the risk actor leveraging a number of beforehand undocumented instruments equivalent to the next –
- Credential Dumper, which targets an already-compromised Area Controller to steal Lively Listing and Area Controller credential-related information
- Passive backdoor, which listens for incoming requests and executes shellcode payloads
- Keylogger, a {custom} C++ device that data all keystrokes and writes them to a file below “C:/home windows/temp/~TNpercentLogName%.tmp”
The keylogger notably lacks any C2 mechanism, which means that it probably works together with one other part that may exfiltrate the file to the attackers.
“Stealth Falcon employs business code obfuscation and safety instruments, in addition to custom-modified variations tailor-made for various payload sorts,” the Examine Level mentioned. “This makes their instruments tougher to reverse-engineer and complicates monitoring technical modifications over time.”
The lively exploitation of CVE-2025-33053 has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) so as to add it to the Recognized Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Govt Department (FCEB) businesses to use the repair by July 1, 2025.
“What makes this flaw notably regarding is the widespread use of WebDAV in enterprise environments for distant file sharing and collaboration,” Mike Walters, President and Co-Founding father of Action1, mentioned. “Many organizations allow WebDAV for professional enterprise wants — typically with out absolutely understanding the security dangers it introduces.”
Probably the most extreme vulnerability resolved by Microsoft is a privilege escalation flaw in Energy Automate (CVE-2025-47966, CVSS rating: 9.8) that would allow an attacker to raise privileges over a community. Nonetheless, there is no such thing as a buyer motion required to mitigate the bug.
Different vulnerabilities of notice embody elevation of privilege flaws in Widespread Log File System Driver (CVE-2025-32713, CVSS rating: 7.8), Home windows Netlogon (CVE-2025-33070, CVSS rating: 8.1), and Home windows SMB Consumer (CVE-2025-33073, CVSS rating: 8.8), in addition to a important unauthenticated RCE vulnerability within the Home windows KDC Proxy Service (CVE-2025-33071, CVSS rating: 8.1).
“Over the previous a number of months, the CLFS driver has grow to be a constant focus for each risk actors and security researchers as a consequence of its exploitation in a number of ransomware operations,” Ben McCarthy, lead cyber security engineer at Immersive mentioned.
“It’s categorized as a heap-based buffer overflow — a kind of reminiscence corruption vulnerability. The assault complexity is taken into account low, and profitable exploitation permits an attacker to escalate privileges.”
Adam Barnett, lead software program engineer at Rapid7, mentioned the exploitation of CVE-2025-33071 requires the attacker to take advantage of a cryptographic flaw and win a race situation.
“The unhealthy information is that Microsoft considers exploitation extra probably regardless, and since a KDC proxy helps Kerberos requests from untrusted networks extra simply entry trusted belongings with none want for a direct TCP connection from the shopper to the area controller, the trade-off right here is that the KDC proxy itself is sort of more likely to be uncovered to an untrusted community,” Barnett added.
Final however not least, Microsoft has additionally rolled out patches to remediate a safe boot bypass bug (CVE-2025-3052, CVSS rating: 6.7) found by Binarly that allows the execution of untrusted software program.
“A vulnerability exists in a UEFI utility signed with a Microsoft third-party UEFI certificates, which permits an attacker to bypass UEFI Safe Boot,” Redmond mentioned in an alert. “An attacker who efficiently exploited this vulnerability might bypass Safe Boot.”
CERT Coordination Heart (CERT/CC), in an advisory launched Tuesday, mentioned the vulnerability is rooted in Unified Extensible Firmware Interface (UEFI) functions DTBios and BiosFlashShell from DT Analysis, permitting Safe Boot bypass utilizing a specifically crafted NVRAM variable.
“The vulnerability stems from improper dealing with of a runtime NVRAM variable that allows an arbitrary write primitive, able to modifying important firmware buildings, together with the worldwide Security2 Architectural Protocol used for Safe Boot verification,” CERT/CC mentioned.
“As a result of the affected functions are signed by the Microsoft UEFI Certificates Authority, this vulnerability will be exploited on any UEFI-compliant system, permitting unsigned code to run in the course of the boot course of.”
Profitable exploitation of the vulnerability might allow the execution of unsigned or malicious code even earlier than the working system hundreds, doubtlessly enabling attackers to drop persistent malware that may survive reboots and even disable security software program.
Microsoft, nevertheless, will not be affected by CVE-2025-4275 (aka Hydroph0bia), one other Safe Boot bypass vulnerability current in an InsydeH2O UEFI utility that permits digital certificates injection by way of an unprotected NVRAM variable (“SecureFlashCertData”), leading to arbitrary code execution on the firmware degree.
“This problem arises from the unsafe use of an NVRAM variable, which is used as trusted storage for a digital certificates within the belief validation chain,” CERT/CC mentioned. “An attacker can retailer their very own certificates on this variable and subsequently run arbitrary firmware (signed by the injected certificates) in the course of the early boot course of inside the UEFI setting.”
Software program Patches from Different Distributors
Along with Microsoft, security updates have additionally been launched by different distributors over the previous few weeks to rectify a number of vulnerabilities, together with —
- Adobe
- Amazon Internet Companies
- AMD
- Arm
- Atlassian
- AutomationDirect
- Bosch
- Broadcom (together with VMware)
- Canon
- Cisco
- D-Hyperlink
- Dell
- Drupal
- F5
- Fortinet
- GitLab
- Google Android and Pixel
- Google Chrome
- Google Cloud
- Hitachi Vitality
- HP
- HP Enterprise (together with Aruba Networking)
- IBM
- Intel
- Insyde
- Ivanti
- Jenkins
- Juniper Networks
- Lenovo
- Linux distributions Amazon Linux, Debian, Oracle Linux, Purple Hat, Rocky Linux, SUSE, and Ubuntu
- MediaTek
- Mitel
- Mitsubishi Electrical
- Moxa
- Mozilla Firefox and Thunderbird
- NVIDIA
- Palo Alto Networks
- Phoenix Applied sciences
- QNAP
- Qualcomm
- Roundcube
- Salesforce
- Samsung
- SAP
- Schneider Electrical
- Siemens
- SolarWinds
- SonicWall
- Splunk
- Spring Framework
- Synology
- Pattern Micro Apex Central, Apex One, Endpoint Encryption PolicyServer, and WFBS
- Veritas
- Zimbra, and
- Zoho ManageEngine Trade Reporter Plus and OpManager
