Microsoft on Tuesday rolled out fixes for an enormous set of 111 safety flaws throughout its software program portfolio, together with one flaw that has been disclosed as publicly recognized on the time of the discharge.
Of the 111 vulnerabilities, 16 are rated Vital, 92 are rated Vital, two are rated Average, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, adopted by distant code execution (35), info disclosure (18), spoofing (8), and denial-of-service (4) defects.
That is along with 16 vulnerabilities addressed in Microsoft’s Chromium-based Edge browser because the launch of final month’s Patch Tuesday replace, together with two spoofing bugs affecting Edge for Android.
Included among the many vulnerabilities is a privilege escalation vulnerability impacting Microsoft Trade Server hybrid deployments (CVE-2025-53786, CVSS rating: 8.0) that Microsoft disclosed final week.
The publicly disclosed zero-day is CVE-2025-53779 (CVSS rating: 7.2), one other privilege escalation flaw in Home windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug.
It is price mentioning right here that the difficulty was publicly detailed again in Could 2025 by the net infrastructure and safety firm, giving it the codename BadSuccessor. The novel approach primarily permits a menace actor with ample privileges to compromise an Lively Listing (AD) area by misusing delegated Managed Service Account (dMSA) objects.
“The excellent news right here is that profitable exploitation of CVE-2025-53779 requires an attacker to have pre-existing management of two attributes of the hopefully nicely protected dMSA: msds-groupMSAMembership, which determines which customers might use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which incorporates an inventory of customers on whose behalf the dMSA can act,” Adam Barnett, lead software program engineer at Rapid7, instructed The Hacker Information.
“Nonetheless, abuse of CVE-2025-53779 is actually believable as the ultimate hyperlink of a multi-exploit chain which stretches from no entry to whole pwnage.”
Action1’s Mike Walters famous that the trail traversal flaw will be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a site administrator, and probably achieve full management of the Lively Listing area.
“An attacker who already has a compromised privileged account can use it to maneuver from restricted administrative rights to full area management,” Walters added. “It may also be paired with strategies akin to Kerberoasting or Silver Ticket assaults to keep up persistence.”
“With area administrator privileges, attackers can disable safety monitoring, modify Group Coverage, and tamper with audit logs to cover their exercise. In multi-forest environments or organizations with companion connections, this flaw might even be leveraged to maneuver from one compromised area to others in a provide chain assault.”
Satnam Narang, senior employees analysis engineer at Tenable, stated the rapid influence of BadSuccessor is proscribed, as solely 0.7% of Lively Listing domains had met the prerequisite on the time of disclosure. “To take advantage of BadSuccessor, an attacker will need to have no less than one area controller in a site operating Home windows Server 2025 with the intention to obtain area compromise,” Narang identified.
A few of notable Vital-rated vulnerabilities patched by Redmond this month are beneath –
CVE-2025-53767 (CVSS rating: 10.0) – Azure OpenAI Elevation of Privilege Vulnerability
CVE-2025-53766 (CVSS rating: 9.8) – GDI+ Distant Code Execution Vulnerability
CVE-2025-50165 (CVSS rating: 9.8) – Home windows Graphics Part Distant Code Execution Vulnerability
CVE-2025-53792 (CVSS rating: 9.1) – Azure Portal Elevation of Privilege Vulnerability
CVE-2025-53787 (CVSS rating: 8.2) – Microsoft 365 Copilot BizChat Info Disclosure Vulnerability
CVE-2025-50177 (CVSS rating: 8.1) – Microsoft Message Queuing (MSMQ) Distant Code Execution Vulnerability
CVE-2025-50176 (CVSS rating: 7.8) – DirectX Graphics Kernel Distant Code Execution Vulnerability
Microsoft famous that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no buyer motion.
Test Level, which disclosed CVE-2025-53766 alongside CVE-2025-30388, stated the vulnerabilities permit attackers to execute arbitrary code on the affected system, resulting in a full system compromise.
“The assault vector entails interacting with a specifically crafted file. When a consumer opens or processes this file, the vulnerability is triggered, permitting the attacker to take management,” the cybersecurity firm stated.
The Israeli agency revealed that it additionally uncovered a vulnerability in a Rust-based part of the Home windows kernel that can lead to a system crash that, in flip, triggers a tough reboot.
“For organizations with massive or distant workforces, the danger is important: attackers might exploit this flaw to concurrently crash quite a few computer systems throughout an enterprise, leading to widespread disruption and expensive downtime,” Test Level stated. “This discovery highlights that even with superior safety applied sciences like Rust, steady vigilance and proactive patching are important to sustaining system integrity in a fancy software program surroundings.”
One other vulnerability of significance is CVE-2025-50154 (CVSS rating: 6.5), an NTLM hash disclosure spoofing vulnerability that is truly a bypass for the same bug (CVE-2025-24054, CVSS rating: 6.5) that was plugged by Microsoft in March 2025.
“The unique vulnerability demonstrated how specifically crafted requests might set off NTLM authentication and expose delicate credentials,” Cymulate researcher Ruben Enkaoua stated. “This new vulnerability […] permits an attacker to extract NTLM hashes with none consumer interplay, even on totally patched programs. By exploiting a delicate hole left within the mitigation, an attacker can set off NTLM authentication requests mechanically, enabling offline cracking or relay assaults to realize unauthorized entry.”
