Microsoft Patches 66 Security Flaws Including Two Active Zero Day Vulnerabilities

Microsoft’s June 2025 Patch Tuesday update addresses 66 security vulnerabilities, including two actively exploited zero-day flaws that pose immediate risks to Windows systems worldwide. The most critical vulnerability, CVE-2025-33053, affects the WebDAV component in Windows and enables attackers to execute malicious code remotely, making immediate patching essential for both enterprise and individual users.

Key Takeaways:

• Two zero-day vulnerabilities are currently under active exploitation in the wild
• The patch addresses 10 critical vulnerabilities across Microsoft Office and Windows components
• WebDAV vulnerability affects both Windows 10 and 11 operating systems
• Remote code execution flaws represent 38.5% of all patches
• Updates cover 35 different Microsoft products and services

Understanding the Zero-Day Threats

The most severe zero-day vulnerability (CVE-2025-33053) targets the WebDAV component, enabling attackers to execute remote code with system privileges. This vulnerability affects all recent Windows versions, including Windows 10 and 11. Security researchers have confirmed active exploitation, making it a priority for immediate patching.

Critical Vulnerabilities Overview

Among the 66 patched vulnerabilities, 10 are classified as Critical. Four of these critical flaws affect Microsoft Office applications, potentially allowing attackers to execute malicious code through specially crafted email attachments. The remaining vulnerabilities are rated as Important, with none falling into the Moderate or Low severity categories.

Affected Products and Services

The June 2025 update extends across numerous Microsoft products. Here are the key affected components:

• Microsoft Edge and .NET Framework
• Office applications (Excel, Outlook, PowerPoint, Word)
• Windows Kernel and LSASS
• Remote Desktop Client
• Nuance Digital Engagement Platform

Security Impact and Recommendations

Microsoft’s security enhancements in this update are crucial for maintaining system integrity. Remote code execution vulnerabilities comprise 38.5% of the total patches, while information disclosure issues account for 26.2%. For automated security management, consider using Latenode’s automation tools to streamline your patch management process.

Enterprise Considerations

Enterprise administrators should prioritize testing and deploying these updates, particularly given the ongoing security concerns. The presence of actively exploited zero-day vulnerabilities makes this patch cycle especially critical for business environments. Organizations should focus on systems exposed to the internet and those handling sensitive data.