August Patch Tuesday: Microsoft Tackles 111 Flaws, Including Critical Kerberos Zero-Day

Microsoft's August 2025 Patch Tuesday has arrived, bringing fixes for a substantial 111 vulnerabilities across its product line. This month's update is particularly noteworthy for addressing a zero-day flaw in Windows Kerberos, a critical authentication protocol, alongside numerous other security weaknesses. Users are strongly advised to apply these patches promptly to mitigate potential risks.

Key Takeaways

• Microsoft released patches for 111 vulnerabilities in August 2025.

• A zero-day vulnerability in Windows Kerberos (CVE-2025-53779) is among the fixes.

• 16 vulnerabilities are rated Critical, and 92 are rated Important.

• Many vulnerabilities allow for privilege escalation and remote code execution.

Kerberos Zero-Day Vulnerability Addressed

The most significant fix in this Patch Tuesday addresses CVE-2025-53779, a zero-day vulnerability in Windows Kerberos. This elevation of privilege flaw, discovered by Yuval Gordon and dubbed "BadSuccessor," could allow an attacker with specific pre-existing control over Delegated Managed Service Accounts (dMSA) to gain domain administrator privileges. While Microsoft initially assessed its exploitation as less likely, its potential impact on Active Directory environments, especially those running Windows Server 2025, makes patching crucial. The vulnerability stems from a relative path traversal issue within the Kerberos implementation.

Critical Vulnerabilities and Other High-Impact Flaws

Beyond the Kerberos zero-day, Microsoft has also resolved 15 other critical vulnerabilities. These include several remote code execution (RCE) flaws, such as CVE-2025-50165 in the Windows Graphics Component and CVE-2025-53766 in GDI+, both carrying a CVSS score of 9.8. Other critical issues affect Azure OpenAI (CVE-2025-53767), Azure Portal, Microsoft 365 Copilot BizChat, and Microsoft Message Queuing (MSMQ).

Many of these critical vulnerabilities, particularly those related to RCE and privilege escalation, can be exploited without user interaction, making them prime targets for attackers. Microsoft has indicated that some of these flaws are considered more likely to be exploited, further emphasizing the need for immediate action.

Vulnerability Breakdown

The 111 vulnerabilities patched this month span various categories:

• Elevation of Privilege (EoP): 44 vulnerabilities

• Remote Code Execution (RCE): 35 vulnerabilities

• Information Disclosure: 18 vulnerabilities

• Spoofing: 8 vulnerabilities

• Denial of Service (DoS): 4 vulnerabilities

• Tampering: 1 vulnerability

• Cross-Site Scripting (XSS): 1 vulnerability

While Microsoft stated it has no evidence of the zero-day being exploited in the wild, the sheer volume and severity of the patched vulnerabilities underscore the importance of staying up-to-date with security updates. Organizations should prioritize patching systems, especially those exposed to the internet or handling sensitive data.

Broader Security Landscape

In addition to Microsoft's updates, several other major vendors have also released security advisories and patches. This includes updates for software from Adobe, Apple, Google, various Linux distributions, and many more, highlighting a busy period for cybersecurity professionals.

Users and administrators are urged to review Microsoft's official security bulletins for detailed information on each vulnerability and to implement the necessary patches across their environments as soon as possible.

As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• August Patch Tuesday: Microsoft addressing 111 vulnerabilities, iTWire.

• Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws, The Hacker News.

• Microsoft's latest major patch fixes a serious zero-day flaw, and a host of other issues, TechRadar.

• August 2025 Patch Tuesday: Microsoft Fixes 111 CVEs & Publicly Disclosed Kerberos Zero-Day(CVE-2025-53779), SOCRadar® Cyber Intelligence Inc..