ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
The Hacker Newspublished ()ingested @TheHackersNews

Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero

criticalVulnerabilityimportance 60CVE-2025-53786CVE-2025-53779CVE-2025-53767CVE-2025-53766CVE-2025-50165CVE-2025-53792CVE-2025-53787CVE-2025-50177CVE-2025-50176CVE-2025-30388CVE-2025-50154CVE-2025-24054
Read the original
Tagscve-2025-53786cve-2025-53779cve-2025-53767cve-2025-53766cve-2025-50165vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2025-24054
NTLM Hash Disclosure Spoofing Vulnerability in Microsoft Windows

CVE-2025-24054 is a spoofing vulnerability in Microsoft Windows NTLM caused by external control of a file name or path (CWE-73): when Windows processes a file whose name or path points to an attacker-controlled resource, the system is induced to authenticate via NTLM to that destination, disclosing the user's NTLM hash. An unauthorized network attacker triggers the flaw by convincing a user to interact with a crafted file, for example downloading or opening a malicious file, which sends NTLM credentials to a host of the attacker's choosing. With the captured NTLM hash, the attacker can attempt relay or offline cracking to spoof and impersonate the user on the network; no privileges are required, but user interaction is needed (CVSS 3.1: 5.4, medium). Any unpatched Windows 10 (1507 through 22H2), Windows 11 (22H2 through 24H2), or Windows Server 2008, 2012, 2016, or 2019 system in environments that use NTLM authentication is affected. The flaw is being actively exploited: CISA added it to the KEV catalog on 2025-04-17, EPSS puts the 30-day exploitation probability at about 59% (99th percentile), public proof-of-concept exploits exist, and multiple attack campaigns have been reported, including targeting of organizations in Poland and Romania shortly after the patch became available.

Do: Apply Microsoft's April 2025 security updates across all listed Windows 10, Windows 11, and Windows Server releases and confirm updated builds through patch-management reporting; the flaw was added to CISA's KEV on 2025-04-17, so federal agencies must patch per BOD 22-01 deadlines or apply vendor mitigations. As interim mitigation, restrict outbound NTLM authentication (for example by blocking outbound TCP 445/139 to untrusted hosts, enforcing SMB signing, or removing NTLM where feasible) and hunt for anomalous outbound NTLM authentication following user file downloads or opening of untrusted shortcut files.

5.459% KEV PoC ×3
  • microsoft Windows 10 1507, 1607, 1809, 21H2, 22H2
  • microsoft Windows 11 22H2, 23H2, 24H2
  • microsoft Windows Server 2008, 2012, 2016, 2019
masshundreds of millions of Windows devices (desktops and servers on the affected Windows 10, Windows 11, and Windows Server releases with NTLM in use)
CVE-2025-30388
Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

NVD description · AI analysis pending		7.84%
  • microsoft 365 copilot
  • microsoft office
  • microsoft office long term servicing channel
  • +1 more
—
CVE-2025-50177
+1 in the same advisory: …50154
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

NVD description · AI analysis pending		8.1
group max
4%
  • microsoft windows 10 1507
  • microsoft windows 10 1607
  • microsoft windows 10 1809
  • +1 more
—
CVE-2025-50165
Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

NVD description · AI analysis pending		9.810%
  • microsoft windows 11 24h2
  • microsoft windows server 2025
—
CVE-2025-50176
Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally.

Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally.

NVD description · AI analysis pending		7.8<1%
  • microsoft windows 11 22h2
  • microsoft windows 11 23h2
  • microsoft windows 11 24h2
  • +1 more
—
CVE-2025-53766
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

NVD description · AI analysis pending		9.87%
  • microsoft 365 copilot
  • microsoft office
  • microsoft windows 10 1507
  • +1 more
—
CVE-2025-53767
Azure OpenAI Elevation of Privilege Vulnerability

Azure OpenAI Elevation of Privilege Vulnerability

NVD description · AI analysis pending		10.01%
  • microsoft azure openai
—
CVE-2025-53779
Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

NVD description · AI analysis pending		7.23%
  • microsoft windows server 2025
—
CVE-2025-53786
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix.

On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

NVD description · AI analysis pending		8.07%
  • microsoft exchange server
  • microsoft exchange server subscription edition
—
CVE-2025-53787
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

NVD description · AI analysis pending		7.5<1%
  • microsoft 365 copilot chat
—
CVE-2025-53792
Azure Portal Elevation of Privilege Vulnerability

Azure Portal Elevation of Privilege Vulnerability

NVD description · AI analysis pending		9.1<1%
  • microsoft azure portal
—
Full article1,078 words · extracted from thehackernews.com · click to collapse

Microsoft on Tuesday rolled out fixes for a massive set of 111 security flaws across its software portfolio, including one flaw that has been disclosed as publicly known at the time of the release.

Of the 111 vulnerabilities, 16 are rated Critical, 92 are rated Important, two are rated Moderate, and one is rated Low in severity. Forty-four of the vulnerabilities relate to privilege escalation, followed by remote code execution (35), information disclosure (18), spoofing (8), and denial-of-service (4) defects.

This is in addition to 16 vulnerabilities addressed in Microsoft's Chromium-based Edge browser since the release of last month's Patch Tuesday update, including two spoofing bugs affecting Edge for Android.

Included among the vulnerabilities is a privilege escalation vulnerability impacting Microsoft Exchange Server hybrid deployments (CVE-2025-53786, CVSS score: 8.0) that Microsoft disclosed last week.

The publicly disclosed zero-day is CVE-2025-53779 (CVSS score: 7.2), another privilege escalation flaw in Windows Kerberos that stems from a case of relative path traversal. Akamai researcher Yuval Gordon has been credited with discovering and reporting the bug.

It's worth mentioning here that the issue was documented in detail back in May 2025 by the web infrastructure and security company, giving it the codename BadSuccessor. The novel technique essentially allows a threat actor with sufficient privileges to compromise an Active Directory (AD) domain by misusing delegated Managed Service Account (dMSA) objects.

"The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," Adam Barnett, lead software engineer at Rapid7, told The Hacker News.

"However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage."

Action1's Mike Walters noted that the path traversal flaw can be abused by an attacker to create improper delegation relationships, enabling them to impersonate privileged accounts, escalate to a domain administrator, and potentially gain full control of the Active Directory domain.

"An attacker who already has a compromised privileged account can use it to move from limited administrative rights to full domain control," Walters added. "It can also be paired with methods such as Kerberoasting or Silver Ticket attacks to maintain persistence."

"With domain administrator privileges, attackers can disable security monitoring, modify Group Policy, and tamper with audit logs to hide their activity. In multi-forest environments or organizations with partner connections, this flaw could even be leveraged to move from one compromised domain to others in a supply chain attack."

Satnam Narang, senior staff research engineer at Tenable, said the immediate impact of BadSuccessor is limited, as only 0.7% of Active Directory domains had met the prerequisite at the time of disclosure. "To exploit BadSuccessor, an attacker must have at least one domain controller in a domain running Windows Server 2025 in order to achieve domain compromise," Narang pointed out.

Some of the notable Critical-rated vulnerabilities patched by Redmond this month are below -

  • CVE-2025-53767 (CVSS score: 10.0) - Azure OpenAI Elevation of Privilege Vulnerability
  • CVE-2025-53766 (CVSS score: 9.8) - GDI+ Remote Code Execution Vulnerability
  • CVE-2025-50165 (CVSS score: 9.8) - Windows Graphics Component Remote Code Execution Vulnerability
  • CVE-2025-53792 (CVSS score: 9.1) - Azure Portal Elevation of Privilege Vulnerability
  • CVE-2025-53787 (CVSS score: 8.2) - Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
  • CVE-2025-50177 (CVSS score: 8.1) - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
  • CVE-2025-50176 (CVSS score: 7.8) - DirectX Graphics Kernel Remote Code Execution Vulnerability

Microsoft noted that the three cloud service CVEs impacting Azure OpenAI, Azure Portal, and Microsoft 365 Copilot BizChat have already been remediated, and that they require no customer action.

Check Point, which disclosed CVE-2025-53766 alongside CVE-2025-30388, said the vulnerabilities allow attackers to execute arbitrary code on the affected system, leading to a full system compromise.

"The attack vector involves interacting with a specially crafted file. When a user opens or processes this file, the vulnerability is triggered, allowing the attacker to take control," the cybersecurity company said.

The Israeli firm revealed that it also uncovered a vulnerability in a Rust-based component of the Windows kernel that can result in a system crash that, in turn, triggers a hard reboot.

"For organizations with large or remote workforces, the risk is significant: attackers could exploit this flaw to simultaneously crash numerous computers across an enterprise, resulting in widespread disruption and costly downtime," Check Point said. "This discovery highlights that even with advanced security technologies like Rust, continuous vigilance and proactive patching are essential to maintaining system integrity in a complex software environment."

Another vulnerability of importance is CVE-2025-50154 (CVSS score: 6.5), an NTLM hash disclosure spoofing vulnerability that's actually a bypass for a similar bug (CVE-2025-24054, CVSS score: 6.5) that was plugged by Microsoft in March 2025.

"The original vulnerability demonstrated how specially crafted requests could trigger NTLM authentication and expose sensitive credentials," Cymulate researcher Ruben Enkaoua said. "This new vulnerability [...] allows an attacker to extract NTLM hashes without any user interaction, even on fully patched systems. By exploiting a subtle gap left in the mitigation, an attacker can trigger NTLM authentication requests automatically, enabling offline cracking or relay attacks to gain unauthorized access."

Software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors over the past several weeks to rectify several vulnerabilities, including —

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/08/microsoft-august-2025-patch-tuesday.html