Microsoft addressed 159 Common Vulnerabilities and Exposures (CVE’s) this month with 8 marked as zero-day vulnerabilities. The most critical Common Vulnerabilities and Exposures (CVE’s) are noted below:
Microsoft Vulnerabilities:
Windows Zero-Days:
- CVE-2025-21333/21334/21335 – Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- Vulnerability not publicly disclosed but actively being exploited in the wild.
- CVE-2025-21186/21366/21395 – Microsoft Access Remote Code Execution Vulnerability
- Publicly disclosed vulnerability with 0 reports of being exploited in the wild.
- CVE-2025-21275 – Windows App Package Installer Elevation of Privilege Vulnerability
- Publicly disclosed vulnerability with 0 reports of being exploited in the wild.
- CVE-2025-21308 – Windows Themes Spoofing Vulnerability
- Publicly disclosed vulnerability with 0 reports of being exploited in the wild.
Other Critical CVE’s:
- CVE-2025-21380 – Azure Marketplace SaaS Resources Information Disclosure Vulnerability
- CVE-2025-21296 – BranchCache Remote Code Execution Vulnerability
- CVE-2025-21294 – Microsoft Digest Authentication Remote Code Execution Vulnerability
- CVE-2025-21385 – Microsoft Purview Information Disclosure Vulnerability
- CVE-2025-21295 – SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
- CVE-2025-21178 – Visual Studio Remote Code Execution Vulnerability
- CVE-2025-21311 – Windows NTLM V1 Elevation of Privilege Vulnerability
- CVE-2025-21298 – Windows OLE Remote Code Execution Vulnerability
- CVE-2025-21307 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
- CVE-2025-21297/21309 – Windows Remote Desktop Services Remote Code Execution Vulnerability
3rd Party Critical CVE’s:
Adobe Products:
- Adobe released 5 patches covering 14 CVE’s in Adobe Animate, Illustrator on iPad, Photoshop, Substance 3D Designer and Substance 3D Stager
Cisco:
Ivanti:
GitHub:
Dell:
Firefox:
Google Chrome:
Chrome Release: January 14th 2025
SAP:
SonicWall:
About FortressSRM Cyber Hygiene Offering:
Software vulnerabilities are one of the top cyber-attack vectors and one in three breaches are the result of vulnerabilities that were known about and should have been already patched.
Keeping operating systems and application software patched and secure is time consuming and tedious – an internal IT resource nightmare. Fortress SRM’s Guardian Managed Patching with Monitoring Service delivers automated, high-efficacy (97%+) updates to Microsoft and over 80 third-party software, ensuring efficient patch deployment to every device, whether on or off network. This includes the deployment of critical updates, security updates, feature updates, operating system upgrades, key Windows security setting and configurations.
The Fortress SRM real-time reporting console includes current patch levels of devices and gives the Client total visibility into what patch related activities have been performed, while real-time patch monitoring provides deep insight into approved, unapproved, pending, and failed patching efforts.
Ready to start the Cyber Hygiene journey? Contact us at: Contact Us | Fortress Security Risk Management (fortresssrm.com)