Microsoft Patch Tuesday June 2025

Microsoft has rolled out its June 2025 Patch Tuesday updates, addressing 66 vulnerabilities across Windows, Office, and other key Microsoft products. This month’s security release includes 10 critical vulnerabilities, with a strong focus on remote code execution (RCE) risks, privilege escalation threats, and authentication bypass flaws.

Among the patched vulnerabilities, CVE-2025-33053 stands out as an actively exploited zero-day affecting WebDAV, while CVE-2025-33073 is a publicly disclosed Windows SMB Client flaw that could allow attackers to elevate privileges.

Organizations are strongly urged to prioritize patching efforts, as cybercriminals often weaponize newly disclosed vulnerabilities within days of their release.

1. Zero-Day Vulnerabilities Fixed in June 2025

🔴 CVE-2025-33053 – WebDAV Remote Code Execution (RCE) Vulnerability

Affected Component: Windows WebDAV client
Impact: Allows remote attackers to execute arbitrary code by sending malicious WebDAV requests to a victim’s machine.
Exploitation Method: Attackers craft a WebDAV URL that, when clicked, triggers malicious execution through improperly validated responses.
Discovery & Attribution: Reported by Check Point Research, linked to Stealth Falcon APT, a group known for espionage attacks targeting Middle Eastern entities.
Severity: Critical
Patch Requirement: Mandatory for all enterprise environments where WebDAV is enabled.

📢 This zero-day is already being exploited in the wild, making immediate patching essential for organizations using WebDAV for file sharing and remote access.

🔴 CVE-2025-33073 – Windows SMB Client Elevation of Privilege (EoP) Vulnerability

Affected Component: Windows SMB client
Impact: Enables attackers to gain SYSTEM privileges by exploiting weak authentication mechanisms in SMB connections.
Exploitation Method: Attackers coerce victim machines into connecting to rogue SMB servers, executing unauthorized commands.
Discovery: Publicly disclosed by RedTeam Pentesting, with warnings circulated by DFN-CERT, increasing likelihood of exploitation.
Severity: High
Recommended Mitigation: Enforce SMB signing via Group Policy and restrict outbound SMB connections to unknown servers.

📢 Security teams should implement SMB hardening measures alongside patch deployment to prevent exploitation.

2. Other Critical Vulnerabilities Patched

Windows Netlogon Elevation of Privilege (CVE-2025-33070)

Threat Level: Critical
Impact: Allows attackers to gain domain administrator privileges, compromising Active Directory environments.

Microsoft Office Remote Code Execution (CVE-2025-47162, CVE-2025-47164, CVE-2025-47167, CVE-2025-47953)

Threat Level: Critical
Impact: Exploitable via Outlook Preview Pane, enabling malware deployment without user interaction.

Windows KDC Proxy Service Remote Code Execution (CVE-2025-33071)

Threat Level: Critical
Impact: Targets Kerberos authentication mechanisms, allowing unauthenticated attackers to execute arbitrary code within Windows Server authentication processes.

📢 These vulnerabilities could serve as entry points for ransomware groups and espionage actors, making immediate patching crucial.

3. Why This Patch Tuesday Matters

🚨 Confirmed Active Exploitation – CVE-2025-33053 (WebDAV RCE) has been actively leveraged in cyberattacks, requiring urgent remediation.
🚨 Public Exploit Code Available – CVE-2025-33073 (Windows SMB Client Privilege Escalation) has proof-of-concept exploit code circulating, increasing risk of widespread attacks.
🚨 Enterprise & Government Impact – Vulnerabilities affect critical infrastructure components, including Windows authentication services, Office products, and network file-sharing mechanisms, making them high-value targets for cybercriminals.

4. Recommended Mitigation Strategies & Next Steps

✅ Immediate Security Actions

✔️ Apply Microsoft’s security updates immediately to mitigate risks across enterprise environments.
✔️ Enforce SMB signing via Group Policy to prevent authentication hijacking exploits.
✔️ Disable WebDAV functionality if not required to block potential RCE attack vectors.
✔️ Monitor threat intelligence feeds for Indicators of Compromise (IoCs) related to Stealth Falcon APT activity targeting WebDAV deployments.

📢 Security teams should integrate proactive monitoring and access control measures to minimize exposure to patched vulnerabilities.