"Let's start our look at Microsoft's relatively quiet final patch-a-thon for 2025 by considering CVE-2025-62221, a 7.8-CVSS-rated Windows Cloud Files Mini Filter Driver vulnerability that allows an authorized attacker to elevate privileges locally. This one was exploited as a zero-day, according to Redmond, and while we don't yet know who is abusing this security hole, "privilege escalation vulnerabilities are observed in almost every incident involving host compromises, making this a critical vulnerability to patch to limit an attacker's capabilities," Kev Breen, senior director of cyber threat research at Immersive, told The Register. To exploit this bug, an attacker must already have code execution rights on the targeted system, but assuming they've already achieved this, they can then abuse CVE-2025-62221 to escalate privileges and gain system-level access. So prioritize patching this one first."
"The two Redmond vulnerabilities listed as publicly known but not (yet) exploited are CVE-2025-54100, a PowerShell Remote Code Execution (RCE) flaw that earned a 7.8 CVSS rating, and CVE-2025-64671, an 8.4-severity GitHub Copilot for Jetbrains bug that can lead to RCE. CVE-2025-64671 is listed as a local, but as Trend Micro's Zero Day Initiative chief bug hunter Dustin Childs, noted: "It's likely that a remote attacker could socially engineer someone to trigger the command injection.""
December Patch Tuesday delivered 57 Microsoft CVEs, including one actively exploited zero-day: CVE-2025-62221, a 7.8 CVSS Windows Cloud Files Mini Filter Driver privilege-escalation vulnerability. The zero-day requires prior code execution to escalate privileges to system level, making it a top patch priority. Two other Microsoft flaws are publicly known: CVE-2025-54100 (PowerShell RCE, 7.8 CVSS) and CVE-2025-64671 (GitHub Copilot for Jetbrains RCE, 8.4 severity) that could be triggered via social engineering. A critical Notepad++ bug is reported abused by attackers in China. Ivanti and Fortinet also released critical product patches.
#microsoft-patch-tuesday #zero-day-privilege-escalation #rce-vulnerabilities #ivantifortinet-patches
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]