Microsoft Fixes Three Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10573 | Stored Cross-Site Scripting in Ivanti Endpoint Manager Exposes Admin Sessions | 6.1 | 33% | ||
| CVE-2025-54100 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code… | 7.8 | 2% | ||
| CVE-2025-62221 | Use-After-Free Local Privilege Escalation in Windows Cloud Files Mini Filter Driver | 7.8 | 3% | KEV | KEV |
CVE-2025-62562+2 related CVEs | Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally | 7.8 | <1% | ||
| CVE-2025-64671 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally | 7.8 | <1% |
From the original article
2 min read at infosecurity-magazine.com
Microsoft patched an actively exploited zero-day vulnerability as part of its monthly security update cycle yesterday. CVE-2025-62221 is an elevation of privilege (EoP) bug in the Windows Cloud Files Mini Filter Driver, which enables a low-privileged user to achieve system-level code execution through a kernel-mode use-after-free flaw.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.