On Tuesday, Microsoft released its highly anticipated May patch update addressing 78 vulnerabilities, including 11 classified as critical and 66 as important. Among these, five vulnerabilities have been publicly exploited, with another two known but not yet targeted by attackers. This update provides fixes for 70 vulnerabilities, while eight were patched earlier in the month.
Key Vulnerabilities
One of the most concerning vulnerabilities is CVE-2025-30397, which is already being exploited to enable remote code execution when users utilize Edge in Internet Explorer mode. The other four exploited vulnerabilities are related to privilege escalation. Additionally, public knowledge of two vulnerabilities includes a remote code execution flaw in Visual Studio and a spoofing vulnerability in Microsoft Defender.
Most of the critical vulnerabilities identified affect Microsoft Office and the Remote Desktop Client. Notably, CVE-2025-29831 presents a remote code execution issue in Windows Remote Desktop, rated as "important," but it requires no authorization for exploitation. This particular vulnerability relies on race conditions that may not always guarantee reliable exploitation, though it could potentially be triggered during system restarts facilitated by denial-of-service vulnerabilities.
Overview of Critical Vulnerabilities
CVE-2025-26646 pertains to .NET and Visual Studio, presenting a spoofing vulnerability, while the CVE-2025-29968 is categorized as a denial-of-service vulnerability related to Active Directory Certificate Services.
Several critical issues related to Azure are highlighted, including:
- CVE-2025-29827: An elevation of privilege vulnerability in Azure Automation (severity 9.9).
- CVE-2025-29813: A critical elevation of privilege vulnerability in Azure DevOps Server (severity 10).
- CVE-2025-29972: A spoofing vulnerability tied to Azure Storage Resource Provider (severity 9.9).
Additional Notable Vulnerabilities
- CVE-2025-30387 is associated with Document Intelligence Studio and rated important, but it has a CVSS score of 9.8, indicating significant risk.
- Vulnerabilities in Microsoft Excel, PowerPoint, and SharePoint Server are rated important, with several relating to remote code execution vulnerabilities.
Additionally, smaller but notable vulnerabilities include CVE-2025-29966 and CVE-2025-29967, both relating to the Remote Desktop Client, classified as critical with CVSS scores of 8.8.
CVE-2025-32704 is another highlighted vulnerability affecting Windows Media (important, CVSS 8.4), and the Windows Hyper-V and NTFS vulnerabilities generally have CVSS scores ranging around 6.2 to 8.8, representing varying levels of risk.
Conclusion
Organizations utilizing Microsoft products are encouraged to implement these patches promptly to mitigate the risks associated with the identified vulnerabilities. Regular updates and awareness of critical vulnerabilities are essential for maintaining system security and protecting sensitive data from ongoing threats. Overall, this patch roll-out underscores the importance of consistent vigilance in cybersecurity practices.