Microsoft released its November 2025 Patch Tuesday, and although the number of fixes (63 CVEs) is far smaller than October’s massive 175-patch update, this month’s rollout includes critical vulnerabilities and one actively exploited zero-day that demands urgent attention.
Actively Exploited Zero-Day
CVE-2025-62215 — Windows Kernel Privilege Escalation (CVSS 7.5)
A race-condition flaw in the Windows Kernel is already being exploited in the wild.
Attackers can use it to escalate privileges after gaining initial access via another vector.
This vulnerability is part of a growing trend: kernel-level flaws being chained with phishing, RMM abuse, or browser exploits to move from user-level compromise to full system takeover.
Critical RCE Vulnerability
CVE-2025-60724 — GDI+ Remote Code Execution (CVSS 9.8)
This GDI+ flaw is the most dangerous in the November update.
- Triggered when a web service processes a malicious metafile
- No user interaction required
- Allows arbitrary code execution or data theft
“The patch for this should be an organization’s highest priority.”
— Ben McCarthy, Immersive Labs
High-Risk Elevation of Privilege Flaw in Kerberos
CVE-2025-60704 — 'CheckSum' Vulnerability (CVSS 7.5)
Reported by Silverfort and affecting any Active Directory environment with Kerberos delegation enabled.
Attackers with stolen credentials could:
✔ Escalate privileges
✔ Move laterally
✔ Impersonate any identity, including domain admins
Thousands of organizations worldwide are exposed.
Cross-Layer RCE in WSL
CVE-2025-62220 — WSL GUI RCE (CVSS 8.8)
Although user interaction is required, the risk extends beyond the desktop layer.
The flaw affects the interface between Windows and Linux subsystems, enabling powerful cross-environment attacks.
Additional Vulnerabilities Likely to Be Exploited
Microsoft also flagged several WinSock Ancillary Function Driver bugs:
- CVE-2025-60719
- CVE-2025-62213
- CVE-2025-62217
All are privilege escalation flaws that:
- Require no user interaction
- Require low-level privileges
- Are considered more likely to be exploited
“If Microsoft says exploitation is likely, organizations should take note.”
— Nick Carroll, Nightwing
What This Means for Security Teams
✔ Patch immediately — especially kernel, Kerberos, GDI+, and WSL components
✔ Review systems for signs of privilege escalation
✔ Harden identity systems (Kerberos delegation, especially)
✔ Validate RCE exposure points (web services, file upload handlers, etc.)
November may look smaller on paper — but the severity and exploitability of these vulnerabilities make this a high-priority patch cycle.
