Analysis of Microsoft Patch Tuesday updates - June 2025

Executive Summary

On Tuesday, June 10, 2025, Microsoft released its monthly security patch addressing 66 vulnerabilities across its products.

By severity:

• Important — 56;
• Critical — 10.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following 2 vulnerabilities. Fixing them is the highest priority:

• CVE-2025-33053 (CVSS 8.8; Important) — Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability (Remote Code Execution). A vulnerability in Microsoft Windows Web Distributed Authoring and Versioning (WEBDAV) allows a remote attacker to execute arbitrary code if a user visits a specially crafted WebDAV URL.
• CVE-2025-33073 (CVSS 8.8; Important) — Windows SMB Client Elevation of Privilege Vulnerability (Elevation of Privilege). Improper access control in the Windows SMB client allows an authenticated attacker to elevate their privileges on the network to SYSTEM by executing a malicious script.

General Overview and Trends

Microsoft’s June 2025 Patch Tuesday includes fixes for 66 vulnerabilities, fewer than in the extensive May release. Despite the lower overall number, the package includes 10 critical vulnerabilities that require urgent attention. Key trends observed this month:

• Large number of remote code execution (RCE) vulnerabilities: A significant share of the fixes, including several critical ones, is aimed at addressing RCE flaws. The main focus was on Microsoft Office (Word, Excel, Outlook, PowerPoint) and Microsoft SharePoint Server, underscoring their role as key attack vectors in enterprise environments.
• Multiple information disclosure vulnerabilities: A distinguishing feature this month is the large number of similar Information Disclosure issues in the Windows Storage Management Provider component. While they are rated as medium severity, their volume may indicate a systemic problem in this component.
• Denial-of-service (DoS) vulnerabilities: Several important fixes were released for DoS issues in network services such as DHCP Server and Local Security Authority (LSA). Exploiting these vulnerabilities could disrupt the stability and availability of key network services.
• Ongoing elevation-of-privilege (EoP) risk: As in previous months, elevation-of-privilege vulnerabilities remain a pressing issue. In June, EoP flaws were fixed in components such as Windows Task Scheduler and Windows Installer, indicating Microsoft’s continued work to harden the system core.

Full List of Vulnerabilities

Below is a table of all vulnerabilities fixed this month.

Conclusion

June’s update, though less extensive than May’s, requires close attention from IT administrators due to the presence of 10 critical vulnerabilities and two actively discussed issues (one exploited, one publicly disclosed). Priority should be given to installing updates for Microsoft Office and SharePoint Server, as vulnerabilities in these products are traditionally used to gain access to corporate networks. Organizations should assess the risks associated with vulnerabilities of the «Denial of Service» type and take measures to protect mission‑critical network services. Timely application of patches for CVE-2025-33053 and CVE-2025-33073 is absolutely necessary to prevent potential attacks. Overall, a proactive vulnerability management strategy and automation of update processes remain best practice for maintaining infrastructure security. Public disclosure of weaknesses inevitably leads to exploit development, so delaying patch installation creates an unjustified risk.