Microsoft Patch Tuesday for April 2025 — Snort rules and prominent vulnerabilities

Summary: Microsoft's April 2025 security update covers 126 vulnerabilities, 11 of them rated critical, and Microsoft has not observed any of them exploited in the wild. All 11 critical entries are remote code execution flaws, four marked "Exploitation more likely," including two in the Remote Desktop Gateway Service (CVE-2025-27480 and CVE-2025-27482, CVSS 8.1) and LDAP flaws CVE-2025-26663 and CVE-2025-26670, also CVSS 8.1.
Bottom line: Four of the critical RCE flaws are rated "Exploitation more likely" by Microsoft, and two of those sit in the Remote Desktop Gateway Service, a component reachable from outside the network. The absence of in-the-wild exploitation this month is a snapshot, not a guarantee, and the LDAP flaws can be triggered by sending a victim a link.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-26663 CVE-2025-26670 CVE-2025-26686 CVE-2025-27480 CVE-2025-27482 CVE-2025-27491 CVE-2025-27745 CVE-2025-27748 CVE-2025-27749 CVE-2025-27752 CVE-2025-29791
Related: Patch Tuesday, April 2025 Edition Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026