Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-59287+2 related CVEs | Deserialization RCE in Microsoft WSUS (Windows Server) | 9.8 group max | 100% | KEVPoC | KEV |
| CVE-2025-2884 | TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with… | 6.6 | <1% | ||
| CVE-2025-47827 | Secure Boot Bypass via Expired Key in IGEL OS Before 11 (CVE-2025-47827) | 4.6 | 5% | KEVPoC | KEV |
| CVE-2025-49708 | Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network | 9.9 | 1% | ||
| CVE-2025-55315 | HTTP Request Smuggling in Microsoft ASP.NET Core Enables Security Feature Bypass | 9.9 | 66% | ||
| CVE-2025-59295 | Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network | 8.8 | 2% |
From the original article
5 min read at thehackernews.com
Microsoft on Tuesday released fixes for a whopping 183 security flaws spanning its products, including three vulnerabilities that have come under active exploitation in the wild, as the tech giant officially ended support for its Windows 10 operating system unless the PCs are enrolled in the Extended Security Updates ( ESU ) program. Of the 183 vulnerabilities, eight of them are non-Microsoft issued CVEs.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.