Microsoft Patch Tuesday for June 2025 — Snort rules and prominent vulnerabilities

Summary: Microsoft's June 2025 security update covers 66 vulnerabilities, 10 of which Microsoft marked critical, and none of which Microsoft has observed being actively exploited in the wild. Nine of the critical entries are remote code execution flaws in Windows Remote Desktop Service, Windows Schannel, the KDC Proxy service, Microsoft Office, Word and SharePoint Server, alongside two critical elevation of privilege flaws in Windows NetLogon and Power Automate.
What's compelling: CVE-2025-33070 is an authentication bypass in Windows NetLogon that Microsoft says could give an attacker domain administrator privileges, and Microsoft rates exploitation as more likely. CVE-2025-47966 in Power Automate carries a CVSS 3.1 base score of 9.8, though Microsoft reports it as fully mitigated with no further action required.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-29828 CVE-2025-32710 CVE-2025-32717 CVE-2025-33071 CVE-2025-47162 CVE-2025-47164 CVE-2025-47167 CVE-2025-47172 CVE-2025-47953
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026