Microsoft Tackles 78 Security Flaws, Including Five Active Zero-Day Vulnerabilities

Microsoft has released its latest Patch Tuesday updates, addressing a total of 78 security vulnerabilities across its software ecosystem. Among these, five critical zero-day vulnerabilities are currently being exploited in the wild, prompting urgent action from users and organizations to apply the necessary patches.

Key Takeaways

• Microsoft patched 78 vulnerabilities, including five zero-days.

• 11 vulnerabilities are rated as Critical, while 66 are Important.

• The five exploited vulnerabilities have CVSS scores ranging from 7.5 to 7.8.

• Federal agencies are required to apply fixes by June 3, 2025.

Overview of Vulnerabilities

The vulnerabilities addressed in this update include a mix of remote code execution, privilege escalation, and information disclosure flaws. Notably, 28 of the vulnerabilities lead to remote code execution, while 21 are classified as privilege escalation bugs. The breakdown of the vulnerabilities is as follows:

Severity	Count
Critical	11
Important	66
Low	1

Details of Exploited Zero-Day Vulnerabilities

The five zero-day vulnerabilities that are currently being exploited include:

1. CVE-2025-30397 - Scripting Engine Memory Corruption Vulnerability (CVSS: 7.5)

2. CVE-2025-30400 - DWM Core Library Elevation of Privilege Vulnerability (CVSS: 7.8)

3. CVE-2025-32701 - Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS: 7.8)

4. CVE-2025-32706 - Another Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS: 7.8)

5. CVE-2025-32709 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS: 7.8)

Implications for Users and Organizations

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply the necessary patches by June 3, 2025. This highlights the urgency for organizations to prioritize these updates to mitigate potential risks.

Additional Security Updates

In addition to the zero-day vulnerabilities, Microsoft’s Patch Tuesday also addressed several other critical issues, including:

• CVE-2025-29813 - A critical privilege escalation flaw in Azure DevOps Server (CVSS: 10.0).

• CVE-2025-26685 - A spoofing vulnerability in Microsoft Defender for Identity (CVSS: 6.5).

With the increasing sophistication of cyber threats, it is crucial for users and organizations to stay vigilant and apply security updates promptly. Microsoft’s latest Patch Tuesday serves as a reminder of the importance of maintaining robust security practices to protect against emerging vulnerabilities.

As cyber threats grow more sophisticated, staying informed is more important than ever. BetterWorld Technology delivers advanced cybersecurity solutions designed to adapt with the threat landscape—ensuring your business stays protected while continuing to innovate. Take the first step toward stronger security—contact us today for a consultation!

Sources

• Microsoft, Apple fix exploited flaws on Patch Tuesday • The Register, The Register.

• Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server, The Hacker News.