Patch Tuesday, June 2025 Edition
Summary: Microsoft released security updates fixing at least 67 vulnerabilities in Windows and its software, including one zero-day flaw under active attack, CVE-2025-33053, a remote code execution bug in the Windows WebDAV implementation. Microsoft also warned that proof-of-concept code is public for CVE-2025-33073, an SMB client elevation-of-privilege flaw with a CVSS score of 8.8 that gives an attacker SYSTEM-level control.
What you should know: CVE-2025-33073 needs no user interaction after the initial connection and reaches SYSTEM on a core Windows protocol used for file and printer sharing, so the public proof-of-concept code puts every unpatched Windows environment in reach. Separately, no fix shipped this month for BadSuccessor, the Windows Server 2025 flaw Akamai disclosed on May 21 that lets an attacker act with the privileges of any user in Active Directory.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-33053CVE-2025-33073CVE-2025-4664CVE-2025-5419
- Related
- CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability Known Exploited Vulnerabilities · Oct 20, 2025CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability Known Exploited Vulnerabilities · Jun 10, 2025CVE-2025-5419: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Known Exploited Vulnerabilities · Jun 05, 2025