Loading story…
Microsoft released its August 2025 Patch Tuesday updates to fix 107 vulnerabilities across its product portfolio, including 13 critical issues. The update included a zero-day privilege-escalation flaw in Windows Kerberos, CVE-2025-53779, which can allow an authenticated attacker to gain elevated privileges over the network as part of the BadSuccessor attack path and potentially reach domain administrator access through delegated managed service accounts in Active Directory.
Microsoft also patched two critical remote code execution vulnerabilities with CVSS 9.8 severity: CVE-2025-50165 in Windows Graphics and CVE-2025-53766 in Windows GDI+. Both flaws can be triggered through specially crafted image or document content, creating a path for code execution if malicious files are processed, and Microsoft urged administrators and users to apply the security updates immediately.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft fixed CVE-2025-53766, a critical remote code execution vulnerability in Windows GDI+ with a CVSS score of 9.8. According to the advisory summary, exploitation can occur via specially crafted image or document content.
Microsoft addressed CVE-2025-50165, a critical remote code execution vulnerability in Windows Graphics with a CVSS score of 9.8. The flaw can be triggered through specially crafted image or document content.
As part of the August 2025 security updates, Microsoft patched CVE-2025-53779, a privilege-escalation flaw in Windows Kerberos. The vulnerability was described as enabling an authenticated attacker to gain elevated privileges over the network in the BadSuccessor attack path, potentially reaching domain administrator access via delegated managed service accounts in Active Directory.
Microsoft issued its August 2025 Patch Tuesday updates, fixing 107 vulnerabilities across its product portfolio, including 13 rated critical. The update included fixes for a Windows Kerberos zero-day and two critical remote code execution flaws in Windows Graphics and Windows GDI+.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for 63 vulnerabilities across its product portfolio, including five rated **critical** and one actively exploited zero-day. The exploited flaw, tracked as **`CVE-2025-62215`**, is a Windows kernel double-free race condition that enables **local privilege escalation** to **SYSTEM** without user interaction, according to Microsoft’s Security Update Guide and CSIRT.SK reporting. The November 2025 updates also addressed additional high-severity issues spanning **Windows**, **Microsoft Office**, **Visual Studio**, **Microsoft Graphics Component (GDI+)**, and **Nuance PowerScribe 360**, with impacts including **remote code execution**, **information disclosure**, and **privilege escalation**. Security advisories for vulnerabilities including **`CVE-2025-60716`** and **`CVE-2025-62215`** were published through Microsoft’s update channels, and defenders were urged to deploy the patches promptly because one flaw was already being exploited in the wild.
Jul 24, 2026
Microsoft released fixes for 61 vulnerabilities in its May security updates, including three zero-days and one critical flaw, with **CVE-2024-30040** and **CVE-2024-30051** confirmed as actively exploited in the wild. The patched issues affect core Microsoft products including Windows, Office, SharePoint, .NET, Visual Studio, and Windows Server, and include a **Windows MSHTML Platform security feature bypass** and a **Windows DWM Core Library elevation-of-privilege flaw** that can allow attackers to gain `SYSTEM` privileges. Researchers who reported **CVE-2024-30051** said they validated the Windows Desktop Window Manager flaw after finding a suspicious document uploaded to VirusTotal, then later observed an exploit in mid-April being used with **QakBot** and other malware. Kaspersky assessed that multiple threat actors likely had access to the exploit before the patch was released, underscoring the urgency for organizations to deploy Microsoft's updates immediately across affected Windows and server environments.
Jul 24, 2026
Microsoft released security updates for **139 vulnerabilities** across Windows, Windows Server, SharePoint, SQL Server, Office, .NET, Azure CycleCloud, and Visual Studio, including **54 remote code execution flaws**, **5 critical issues**, and **4 zero-days**. The most severe vulnerabilities affected **Microsoft SharePoint Server**, the **Windows Imaging Component**, and the **Windows Remote Desktop Licensing Service**, expanding the risk of remote compromise, privilege escalation, spoofing, security feature bypass, unauthorized data access, and denial-of-service attacks. Two of the zero-days, **`CVE-2024-38080`** and **`CVE-2024-38112`**, were reported as **actively exploited in the wild**, increasing urgency for defenders to deploy the July updates. Microsoft also published advisories for additional vulnerabilities including **`CVE-2024-38023`**, **`CVE-2024-38060`**, **`CVE-2024-38074`**, and **`CVE-2024-38076`**, underscoring the breadth of the release and the need for rapid patching across enterprise Microsoft environments.
Jul 24, 2026