Microsoft has released its December 2025 Patch Tuesday updates, addressing 57 security vulnerabilities, including:
- 1 actively exploited zero-day
- 2 publicly disclosed zero-days
- 3 Critical RCE flaws
🔢 Breakdown of vulnerabilities
- 28 Elevation of Privilege
- 19 Remote Code Execution
- 4 Information Disclosure
- 3 Denial of Service
- 2 Spoofing
(Note: These totals do not include the 15 Microsoft Edge vulnerabilities patched earlier this month.)
⚠️ Three Zero-Days — One Exploited in the Wild
🔥 Actively exploited zero-day
CVE-2025-62221 — Windows Cloud Files Mini Filter Driver (EoP)
A use-after-free vulnerability allowing local attackers to escalate privileges to SYSTEM.
Attributed to MSTIC and MSRC.
🟡 Publicly disclosed zero-days
1️⃣ CVE-2025-64671 — GitHub Copilot for JetBrains (RCE)
A command injection flaw that can be triggered through malicious Cross Prompt Injection in untrusted files or MCP servers.
Reported by Ari Marzuk (“IDEsaster” research).
2️⃣ CVE-2025-54100 — PowerShell Remote Code Execution
Improper command neutralization allows scripts embedded in a webpage to execute when retrieved via Invoke-WebRequest.
Microsoft has introduced a new safety prompt requiring -UseBasicParsing.
🟥 Critical RCE vulnerabilities patched
This month's update includes Critical fixes across:
- Microsoft Office (Word, Excel, Outlook)
- Azure Monitor Agent
- SAP / React / Adobe / Fortinet / Ivanti also released patches independently.
React’s newly named React2Shell RCE flaw is already being exploited in the wild.
📌 Other Vendors with December Security Updates
- Adobe: ColdFusion, Acrobat, AEM, DNG SDK
- Fortinet: Critical FortiCloud SSO Auth Bypass
- Google: Android December bulletin (2 exploited flaws)
- Ivanti: Patch for 9.6/10 Stored XSS in Endpoint Manager
- React: Patch for React2Shell RCE
- SAP: Fix for 9.9/10 Code Injection in Solution Manager
🛡️ Why This Patch Tuesday Matters
With active exploitation, rapidly disclosed AI-related vulnerabilities (such as Copilot / IDEs), and widespread RCE risks across productivity and cloud components, timely patching is crucial.
Organizations should:
✔️ Prioritize zero-days and Critical RCEs
✔️ Reassess PowerShell execution policies
✔️ Validate developer toolchain security (MCP, Copilot, AI IDEs)
✔️ Apply vendor updates across cloud, endpoint, and CI/CD systems
