Microsoft Fixes Seven Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-2351 | A vulnerability classified as critical was found in DayCloud StudentManage 1.0 | 6.9 | <1% | ||
| CVE-2025-26685 | Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network | 6.5 | <1% | ||
CVE-2025-32706+4 related CVEs | Heap-Based Buffer Overflow in Windows CLFS Driver Enables Local Privilege Escalation | 7.8 group max | 2% | KEVPoC ×2 | KEV |
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2025-32702 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally | 7.8 | <1% | ||
| CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader | 9.1 | 13% | KEVRansomwarePoC | KEV |
From the original article
2 min read at infosecurity-magazine.com
Microsoft has released security updates to fix seven zero-day vulnerabilities, five of which are under active exploitation. This month’s Patch Tuesday saw the tech giant release fixes for over 70 vulnerabilities, including five actively exploited zero-days, which are: CVE-2025-32701: An elevation of privilege (EoP) vulnerability in Windows Common Log File System Driver
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.