Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-36033 | Local Privilege Escalation in Microsoft Windows DWM Core Library | 7.8 | 11% | KEV | KEV |
| CVE-2024-30051 | Elevation of Privilege in Microsoft Windows DWM Core Library (Actively Exploited) | 7.8 | 6% | KEVRansomware | KEV |
| CVE-2024-38193 | Use-After-Free Privilege Escalation in Microsoft Windows WinSock Driver (afd.sys) | 7.8 | 29% | KEVPoC | KEV |
| CVE-2025-21418 | Local Privilege Escalation via Heap Overflow in Windows WinSock AFD Driver | 7.8 | 2% | KEV | KEV |
| CVE-2025-26684 | External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally | 6.7 | <1% | ||
| CVE-2025-26685 | Improper authentication in Microsoft Defender for Identity allows an unauthorized attacker to perform spoofing over an adjacent network | 6.5 | <1% | ||
| CVE-2025-29813 | Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network | 9.8 | 2% | ||
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
CVE-2025-32706+4 related CVEs | Heap-Based Buffer Overflow in Windows CLFS Driver Enables Local Privilege Escalation | 7.8 group max | 2% | KEVPoC ×2 | KEV |
From the original article
5 min read at thehackernews.com
Microsoft on Tuesday shipped fixes to address a total of 78 security flaws across its software lineup, including a set of five zero-days that have come under active exploitation in the wild. Of the 78 flaws resolved by the tech giant, 11 are rated Critical, 66 are rated Important, and one is rated Low in severity.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.