The June 2025 Patch Tuesday replace bundle from Microsoft addressed quite a few essential vulnerabilities and zero-day flaws. With over 70 totally different vulnerability fixes, this replace bundle is important for all Microsoft customers to replace their units to.
5 Actively Exploited Zero-Day Flaws Patched
An important safety fixes with June Patch Tuesday tackle 5 vulnerabilities for which Microsoft confirmed to have detected lively exploitation. These embrace,
- CVE-2025-30400 (essential severity; CVSS 7.8): A use-after-free vulnerability impacting Microsoft DWM Core Library resulting in privilege escalation. Exploiting the vulnerability may enable SYSTEM privileges to a licensed attacker.
- CVE-2025-30397 (essential severity; CVSS 7.5): A kind confusion vulnerability in Microsoft Scripting Engine that would enable distant code execution to an unauthorized adversary. Exploiting this flaw required the attacker to ship a specifically crafted URL that the sufferer would open utilizing Edge in Web Explorer Mode.
- CVE-2025-32709 (essential severity; CVSS 7.8): One other use after free vulnerability that impacted Home windows Ancillary Operate Driver for WinSock, permitting elevated privileges (together with admin privileges) to a licensed attacker.
- CVE-2025-32701 (essential severity; CVSS 7.8): A use after free vulnerability in Home windows Widespread Log File System Driver, permitting elevated privileges, together with SYSTEM privileges, to a licensed adversary.
- CVE-2025-32706 (essential severity; CVSS 7.8): One other privilege escalation vulnerability in Home windows Widespread Log File System Driver that existed because of improper enter validation. Exploiting the flaw would grant SYSTEM privileges to a licensed attacker.
Different Essential Patch Tuesday Fixes From Microsoft In June
Alongside the 5 actively exploited zero-days, Microsoft additionally addressed two different essential severity vulnerabilities that turned public prior fixes.
- CVE-2025-26685 (essential severity; CVSS 6.8): An improper authentication situation in Microsoft Defender for Id that would enable an unauthorized attacker to carry out spoofing.
- CVE-2025-32702 (essential severity; CVSS 7.8): A command injection vulnerability in Visible Studio that would enable an unauthorized attacker to execute codes.
As well as, this month’s replace bundle addressed 11 essential severity vulnerabilities as effectively. These embrace 6 distant code execution vulnerabilities, 2 privilege escalation flaws, 1 flaw permitting spoofing, and 1 info disclosure.
The remainder consists of safety fixes for 59 essential severity vulnerabilities, together with 7 denial of service, 15 privilege escalation vulnerabilities, 14 info disclosure, 20 distant code execution flaws, 1 spoofing, and a couple of safety function bypass vulnerabilities.
Provided that this replace bundle addresses no low-severity vulnerabilities, it’s a essential safety replace for all eligible units. Whereas Microsoft rolls out these updates mechanically, customers ought to nonetheless test their programs manually for any updates to make sure receiving all patches on time.
Notably, the units weak to the zero-day flaws beneath assault want fast consideration to stop potential threats.
Tell us your ideas within the feedback.
