Microsoft has launched patches to repair 67 safety flaws, together with one zero-day bug in Internet Distributed Authoring and Versioning (WEBDAV) that it mentioned has come below lively exploitation within the wild.
Of the 67 vulnerabilities, 11 are rated Essential and 56 are rated Essential in severity. This consists of 26 distant code execution flaws, 17 info disclosure flaws, and 14 privilege escalation flaws.
The patches are along with 13 shortcomings addressed by the corporate in its Chromium-based Edge browser for the reason that launch of final month’s Patch Tuesday replace.
The vulnerability that has been weaponized in real-world assaults issues a distant code execution in WEBDAV (CVE-2025-33053, CVSS rating: 8.8) that may be triggered by deceiving customers into clicking on a specifically crafted URL.
The tech big credited Verify Level researchers Alexandra Gofman and David Driker for locating and reporting the bug. It is price mentioning that CVE-2025-33053 is the primary zero-day vulnerability to be disclosed within the WebDAV commonplace.
In a separate report, the cybersecurity firm attributed the abuse of CVE-2025-33053 to a risk actor referred to as Stealth Falcon (aka FruityArmor), which has a historical past of leveraging Home windows zero-days in its assaults. In September 2023, the hacking group was noticed utilizing a backdoor dubbed Deadglyph as a part of an espionage marketing campaign aimed toward entities in Qatar and Saudi Arabia.
“The assault used a .url file that exploited a zero-day vulnerability (CVE-2025-33053) to execute malware from an actor-controlled WebDAV server,” Verify Level mentioned. “CVE-2025-33053 permits distant code execution via manipulation of the working listing.”
Within the assault chain noticed in opposition to an unnamed protection firm in Turkey, the risk actor is claimed to have employed CVE-2025-33053 to ship Horus Agent, a {custom} implant constructed for the Mythic command-and-control (C2) framework. It is believed that the malicious payload used to provoke the assault, a URL shortcut file, was despatched as an archived attachment in a phishing electronic mail.
The URL file is used to launch iediagcmd.exe, a reputable diagnostics utility for Web Explorer, leveraging it to launch one other payload known as Horus Loader, which is chargeable for serving a decoy PDF doc and executing Horus Agent.
“Written in C++, the implant reveals no important overlap with recognized C-based Mythic brokers, apart from commonalities within the generic logic associated to Mythic C2 communications,” Verify Level mentioned. “Whereas the loader makes certain to implement some measures to guard the payload, the risk actors positioned further precautions inside the backdoor itself.”
This consists of using methods like string encryption and management move flattening to complicate evaluation efforts. The backdoor then connects to a distant server to fetch duties that enable it to gather system info, enumerate information and folders, obtain information from the server, inject shellcode into operating processes, and exit this system.
 |
| CVE-2025-33053 an infection chain |
Horus Agent is assessed to be an evolution of the custom-made Apollo implant, an open-source .NET agent for Mythic framework, that was beforehand put to make use of by Stealth Falcon between 2022 and 2023.
“Horus is a extra superior model of the risk teams’ {custom} Apollo implant, rewritten in C++, improved, and refactored,” Verify Level mentioned.
“Much like the Horus model, the Apollo model introduces in depth sufferer fingerprinting capabilities whereas limiting the variety of supported instructions. This enables the risk actors to give attention to stealthy identification of the contaminated machine and subsequent stage payload supply, whereas additionally protecting the implant dimension considerably smaller (solely 120Kb) than the complete agent.”
The corporate mentioned it additionally noticed the risk actor leveraging a number of beforehand undocumented instruments akin to the next –
- Credential Dumper, which targets an already-compromised Area Controller to steal Lively Listing and Area Controller credential-related information
- Passive backdoor, which listens for incoming requests and executes shellcode payloads
- Keylogger, a {custom} C++ software that information all keystrokes and writes them to a file below “C:/home windows/temp/~TNpercentLogName%.tmp”
The keylogger notably lacks any C2 mechanism, that means that it possible works together with one other part that may exfiltrate the file to the attackers.
“Stealth Falcon employs industrial code obfuscation and safety instruments, in addition to custom-modified variations tailor-made for various payload sorts,” the Verify Level mentioned. “This makes their instruments harder to reverse-engineer and complicates monitoring technical adjustments over time.”
The lively exploitation of CVE-2025-33053 has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) so as to add it to the Identified Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Government Department (FCEB) companies to use the repair by July 1, 2025.
“What makes this flaw significantly regarding is the widespread use of WebDAV in enterprise environments for distant file sharing and collaboration,” Mike Walters, President and Co-Founding father of Action1, mentioned. “Many organizations allow WebDAV for reputable enterprise wants — typically with out absolutely understanding the safety dangers it introduces.”
Probably the most extreme vulnerability resolved by Microsoft is a privilege escalation flaw in Energy Automate (CVE-2025-47966, CVSS rating: 9.8) that might allow an attacker to raise privileges over a community. Nevertheless, there isn’t any buyer motion required to mitigate the bug.
Different vulnerabilities of word embody elevation of privilege flaws in Widespread Log File System Driver (CVE-2025-32713, CVSS rating: 7.8), Home windows Netlogon (CVE-2025-33070, CVSS rating: 8.1), and Home windows SMB Consumer (CVE-2025-33073, CVSS rating: 8.8), in addition to a essential unauthenticated RCE vulnerability within the Home windows KDC Proxy Service (CVE-2025-33071, CVSS rating: 8.1).
“Over the previous a number of months, the CLFS driver has turn into a constant focus for each risk actors and safety researchers on account of its exploitation in a number of ransomware operations,” Ben McCarthy, lead cyber safety engineer at Immersive mentioned.
“It’s categorized as a heap-based buffer overflow — a kind of reminiscence corruption vulnerability. The assault complexity is taken into account low, and profitable exploitation permits an attacker to escalate privileges.”
Adam Barnett, lead software program engineer at Rapid7, mentioned the exploitation of CVE-2025-33071 requires the attacker to use a cryptographic flaw and win a race situation.
“The dangerous information is that Microsoft considers exploitation extra possible regardless, and since a KDC proxy helps Kerberos requests from untrusted networks extra simply entry trusted belongings with none want for a direct TCP connection from the consumer to the area controller, the trade-off right here is that the KDC proxy itself is kind of prone to be uncovered to an untrusted community,” Barnett added.
Final however not least, Microsoft has additionally rolled out patches to remediate a safe boot bypass bug (CVE-2025-3052, CVSS rating: 6.7) found by Binarly that allows the execution of untrusted software program.
“A vulnerability exists in a UEFI utility signed with a Microsoft third-party UEFI certificates, which permits an attacker to bypass UEFI Safe Boot,” Redmond mentioned in an alert. “An attacker who efficiently exploited this vulnerability might bypass Safe Boot.”
CERT Coordination Heart (CERT/CC), in an advisory launched Tuesday, mentioned the vulnerability is rooted in Unified Extensible Firmware Interface (UEFI) purposes DTBios and BiosFlashShell from DT Analysis, permitting Safe Boot bypass utilizing a specifically crafted NVRAM variable.
“The vulnerability stems from improper dealing with of a runtime NVRAM variable that allows an arbitrary write primitive, able to modifying essential firmware constructions, together with the worldwide Security2 Architectural Protocol used for Safe Boot verification,” CERT/CC mentioned.
“As a result of the affected purposes are signed by the Microsoft UEFI Certificates Authority, this vulnerability could be exploited on any UEFI-compliant system, permitting unsigned code to run through the boot course of.”
Profitable exploitation of the vulnerability might allow the execution of unsigned or malicious code even earlier than the working system masses, doubtlessly enabling attackers to drop persistent malware that may survive reboots and even disable safety software program.
Microsoft, nonetheless, isn’t affected by CVE-2025-4275 (aka Hydroph0bia), one other Safe Boot bypass vulnerability current in an InsydeH2O UEFI utility that permits digital certificates injection via an unprotected NVRAM variable (“SecureFlashCertData”), leading to arbitrary code execution on the firmware degree.
“This situation arises from the unsafe use of an NVRAM variable, which is used as trusted storage for a digital certificates within the belief validation chain,” CERT/CC mentioned. “An attacker can retailer their very own certificates on this variable and subsequently run arbitrary firmware (signed by the injected certificates) through the early boot course of inside the UEFI atmosphere.”
Software program Patches from Different Distributors
Along with Microsoft, safety updates have additionally been launched by different distributors over the previous few weeks to rectify a number of vulnerabilities, together with —
- Adobe
- Amazon Internet Providers
- AMD
- Arm
- Atlassian
- AutomationDirect
- Bosch
- Broadcom (together with VMware)
- Canon
- Cisco
- D-Hyperlink
- Dell
- Drupal
- F5
- Fortinet
- GitLab
- Google Android and Pixel
- Google Chrome
- Google Cloud
- Hitachi Vitality
- HP
- HP Enterprise (together with Aruba Networking)
- IBM
- Intel
- Insyde
- Ivanti
- Jenkins
- Juniper Networks
- Lenovo
- Linux distributions Amazon Linux, Debian, Oracle Linux, Pink Hat, Rocky Linux, SUSE, and Ubuntu
- MediaTek
- Mitel
- Mitsubishi Electrical
- Moxa
- Mozilla Firefox and Thunderbird
- NVIDIA
- Palo Alto Networks
- Phoenix Applied sciences
- QNAP
- Qualcomm
- Roundcube
- Salesforce
- Samsung
- SAP
- Schneider Electrical
- Siemens
- SolarWinds
- SonicWall
- Splunk
- Spring Framework
- Synology
- Pattern Micro Apex Central, Apex One, Endpoint Encryption PolicyServer, and WFBS
- Veritas
- Zimbra, and
- Zoho ManageEngine Change Reporter Plus and OpManager
