Microsoft Patch Tuesday June 2025

Microsoft has released its monthly Patch Tuesday updates, addressing a total of 66 vulnerabilities in its product suite. This release includes a remediation for one zero-day vulnerability that is currently being actively exploited, as well as another vulnerability that has been publicly disclosed.

The June 2025 security release represents a significant update, featuring 10 critical vulnerabilities that require immediate attention from IT administrators worldwide.

The June 2025 Patch Tuesday addresses vulnerabilities across multiple categories:

• 25 Remote Code Execution vulnerabilities
• 13 Elevation of Privilege vulnerabilities
• 17 Information Disclosure vulnerabilities
• 6 Denial of Service vulnerabilities
• 3 Security Feature Bypass vulnerabilities
• 2 Spoofing vulnerabilities

Zero-Day Vulnerability Under Attack

The most concerning vulnerability in this month’s release is CVE-2025-33053, a remote code execution flaw in Microsoft’s Web Distributed Authoring and Versioning (WebDAV) service.

Security researchers from Check Point Research discovered this vulnerability being actively exploited by the Stealth Falcon advanced persistent threat (APT) group in targeted attacks against defense organizations.

The WebDAV vulnerability allows remote attackers to execute arbitrary code on affected systems when users click on specially crafted WebDAV URLs.

Check Point’s investigation revealed that Stealth Falcon used malicious .url files to exploit this zero-day, manipulating the working directory of legitimate Windows tools to execute malware from actor-controlled WebDAV servers.

A second zero-day vulnerability, CVE-2025-33073, was not actively exploited, yet it affects Windows SMB Client and enables elevation of privilege attacks over networks. This publicly disclosed flaw allows authorized attackers to gain SYSTEM privileges by executing specially crafted scripts that coerce victim machines to authenticate via SMB.

German security firm RedTeam Pentesting originally discovered this vulnerability, with warnings circulating through DFN-CERT before Microsoft’s official patch.

Microsoft Office applications received significant attention with multiple critical remote code execution fixes, including heap-based buffer overflow vulnerabilities that could enable local code execution without user interaction. SharePoint Server also received critical patches for remote code execution flaws that could compromise enterprise collaboration environments.

Several core Windows components received critical security updates, including the Windows KDC Proxy Service (KPSSVC) which had a use-after-free vulnerability enabling network-based code execution.

The Windows Netlogon service received a critical elevation of privilege fix, while Windows Remote Desktop Services addressed a critical remote code execution vulnerability.

The Schannel component, responsible for secure communications, received a critical remote code execution patch affecting Windows cryptographic services. These fixes are particularly important for organizations running Windows Server environments and remote access solutions.

Security experts recommend prioritizing the installation of these updates, especially for the two zero-day vulnerabilities. The WebDAV zero-day (CVE-2025-33053) poses an immediate risk to organizations with internet-facing systems, while the SMB vulnerability (CVE-2025-33073) threatens internal network security.

Microsoft Patch Tuesday June 2025 List

This table is sorted with Critical severity vulnerabilities listed first, followed by Important severity vulnerabilities, as requested.

Microsoft has indicated that proof-of-concept exploits could be rapidly developed by analyzing the published security updates, making swift deployment critical. Organizations should prioritize patching internet-facing systems and domain-joined machines first, while implementing network segmentation as an additional defensive measure.

The June 2025 Patch Tuesday represents one of the more significant monthly releases, combining actively exploited threats with comprehensive fixes across Microsoft’s enterprise and consumer product lines.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access