Two Microsoft Zero-Days for Admins to Fix in June Patch Tuesday
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-33053 | Memory corruption when multiple threads try to unregister the CVP buffer at the same time. Memory corruption when multiple threads try to unregister the CVP buffer at the same time. NVD description · AI analysis pending | 6.7 | <1% |
| — | ||
| CVE-2025-33073 | Improper Access Control Privilege Escalation in Microsoft Windows SMB Client CVE-2025-33073 is an improper access control flaw (CWE-284) in the Windows SMB client that allows an authorized, low-privileged attacker to elevate privileges over the network (CVSS 3.1: 8.8). The attack is network-based with low attack complexity and no user interaction: the attacker must get a vulnerable Windows machine's SMB client to connect to their crafted SMB server, and crafted server responses during the client's authentication flow cause the client to grant the attacker elevated (reportedly SYSTEM-level) access. An attacker gains local privilege elevation on the connecting Windows client, which can be used for full host compromise and lateral movement. Affected systems include essentially all currently supported Windows desktop and server branches in the data: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008, 2012, 2016 and 2019. The flaw is actively exploited in the wild — CISA added it to the KEV catalog on 2025-10-20 (ransomware linkage unknown), and EPSS places it at an 80.5% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's June 2025 (or later) cumulative security updates that address CVE-2025-33073 on all listed Windows 10, Windows 11, and Windows Server systems, prioritizing domain-critical, internet-reachable, and server assets given active exploitation. If immediate patching is not possible, restrict SMB client access to trusted servers and follow Microsoft guidance on hardening NTLM authentication; note that federal agencies must meet CISA KEV/BOD 22-01 remediation timelines following the 2025-10-20 KEV listing. Verify the update actually landed on each host (checking that CVE-2025-33073 is listed as addressed) and hunt for connections to untrusted SMB servers from Windows clients. | 8.8 | 83% | KEV |
| masshundreds of millions of Windows endpoints and servers (SMB client is present and reachable by default across the listed Windows 10/11 and Windows Server… |
Full article369 words · extracted from infosecurity-magazine.com · click to collapse
June is set to be a relatively quiet month for sysadmins, with Microsoft patching just two zero-day vulnerabilities – one of which has been exploited in the wild.
The exploited zero-day is CVE-2024-33053, rated as “important” by Microsoft with a CVSS score of 8.8.
It’s a remote code execution (RCE) bug in the Web Distributed Authoring and Versioning (WebDav) HTTP extension, which could allow attackers to execute arbitrary code with elevated privileges.
It represents a major risk, given the large number of enterprises thought to use WebDAV for remote file management in document management systems, collaboration platforms and legacy file-sharing tools, according to Seth Hoyt, senior security engineer at Automox.
“This vulnerability stems from how WebDAV handles file commands like PUT and MOVE, which can be abused when the service is misconfigured or unnecessarily exposed. Although WebDAV isn’t enabled by default, its presence in legacy or specialized systems still makes it a relevant target,” he explained.
“The attack involves uploading a malicious file using a PUT request, renaming it via MOVE with a semicolon-injected filename, and triggering execution through a crafted URL, effectively bypassing standard security controls.”
Microsoft also classes publicly disclosed flaws that have yet to be exploited as “zero-days.” In this category, it listed one vulnerability this Patch Tuesday: CVE-2025-33073.
This is an “important”-rated elevation of privilege (EoP) vulnerability in the Windows Server Message Block (SMB) client, which also has a CVSS score of 8.8.
EoP bugs are highly sought-after by threat actors, according to Ben McCarthy, lead cybersecurity engineer at Immersive.
“Once an attacker has gained an initial foothold on a machine, often through methods like phishing or exploiting another vulnerability, they can leverage privilege escalation flaws to gain deeper control,” he explained.
“With elevated privileges, an attacker could potentially disable security tools, access and exfiltrate sensitive data, install persistent malware, or move laterally across the network to compromise additional systems.”
Given the critical role SMB plays in Windows networking, administrators should prioritize patching this bug, McCarthy argued.
In total there were 66 CVEs fixed this Patch Tuesday, including 10 RCE bugs, which ranks June among the lightest update rounds this year.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/two-microsoft-zero-days-june-patch/