Microsoft June 2025 Patch Tuesday fixes exploited zero-day, 66 flaws

On this June 2025 Patch Tuesday, Microsoft has rolled out security updates addressing a total of 66 vulnerabilities. Among these, one vulnerability is actively being exploited, while another has been publicly disclosed. The updates include fixes for ten “Critical” vulnerabilities, with eight categorized as remote code execution vulnerabilities and two related to elevation of privileges.

The breakdown of vulnerabilities by category is as follows:

• 13 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 25 Remote Code Execution Vulnerabilities
• 17 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

It is important to note that this count excludes vulnerabilities addressed earlier this month in Mariner, Microsoft Edge, and Power Automate.

For those interested in non-security updates, dedicated articles are available on the Windows 11 cumulative updates KB5060842 and KB5060999, as well as the Windows 10 cumulative update KB5060533.

Two zero-days

This month’s Patch Tuesday addresses one actively exploited zero-day vulnerability and another that has been publicly disclosed. Microsoft defines a zero-day flaw as one that is either publicly disclosed or actively exploited without an official fix available.

The actively exploited zero-day vulnerability included in today’s updates is:

CVE-2025-33053 – Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability

This vulnerability was identified by Check Point Research, which states, “A remote code execution vulnerability exists in Microsoft Windows Web Distributed Authoring and Versioning. Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system.” Exploitation requires the user to click on a specially crafted WebDAV URL.

Check Point Research has reported that this vulnerability was exploited in zero-day attacks by an APT group known as “Stealth Falcon.” In March 2025, they identified an attempted cyberattack against a defense company in Turkey, where the attackers used a previously undisclosed technique to execute files hosted on a WebDAV server they controlled.

Following responsible disclosure, Microsoft assigned the vulnerability CVE-2025-33053 and released a patch on June 10, 2025, as part of their June Patch Tuesday updates. The discovery of this flaw is credited to Alexandra Gofman and David Driker from Check Point Research.

The publicly disclosed zero-day vulnerability is:

CVE-2025-33073 – Windows SMB Client Elevation of Privilege Vulnerability

This flaw allows attackers to gain SYSTEM privileges on vulnerable devices due to improper access control in Windows SMB. Microsoft explains, “To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.” Although an update is now available, the flaw can be mitigated by enforcing server-side SMB signing via Group Policy.

The discovery of this vulnerability is attributed to multiple researchers, including Keisuke Hirata from CrowdStrike, Synacktiv research team, Stefan Walter from SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw from Google Project Zero.

Recent updates from other companies

In addition to Microsoft, several other vendors have released updates or advisories in June 2025:

• Adobe issued security updates for InCopy, Experience Manager, Commerce, InDesign, Substance 3D Sampler, Acrobat Reader, and Substance 3D Painter.
• Cisco released patches for three vulnerabilities with public exploit code in its Identity Services Engine (ISE) and Customer Collaboration Platform (CCP) products.
• Fortinet provided security updates for an OS command injection vulnerability in FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData products.
• Google released June 2025 security updates for Android, addressing numerous vulnerabilities, including an actively exploited zero-day flaw in Google Chrome.
• Hewlett Packard Enterprise (HPE) issued security updates to fix eight vulnerabilities impacting StoreOnce.
• Ivanti released updates to address three high-severity hardcoded key vulnerabilities in Workspace Control (IWC).
• Qualcomm released security updates for three zero-day vulnerabilities in the Adreno Graphics Processing Unit (GPU) driver, which are being exploited in targeted attacks.
• Roundcube provided security updates for a critical remote code execution flaw that is currently being exploited in attacks.
• SAP released security updates for multiple products, including a critical missing authorization check in SAP NetWeaver Application Server for ABAP.

The June 2025 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the June 2025 Patch Tuesday updates. For a full description of each vulnerability and the systems it affects, please refer to the complete report.