What’s New Wednesday: Patch Tuesday June 2025 June 11, 2025 – Posted in: IT Support, What's New Wednesdays – Tags: Cyber Security, Patch Tuesday, SmallBusiness, WhatsNewWednesday

Welcome to Patch Tuesday June 2025. 72 flaws were patched including 6 critical and 2 zero-day vulnerabilities, both of which have been actively exploited. It’s a good idea to restart your PC today, and we may well restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Overall Microsoft patched:

• 13 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 25 Remote Code Execution Vulnerabilities
• 17 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerability

There were 2 actively zero-day vulnerabilities patched, one publicly disclosed and one actively exploited:
CVE-2025-33053 – Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability
A remote code execution vulnerability has been patched in Microsoft Windows Web Distributed Authoring and Versioning, successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
CVE-2025-33073 – Windows SMB Client Elevation of Privilege Vulnerability
Microsoft fixed a flaw in Windows SMB that allows attackers to gain SYSTEM privileges on vulnerable devices.

Releases from other software providers include:

• Adobe – security updates for InCopy, Experience Manager, Commerce, InDesign, Substance 3D Sampler, Acrobat Reader, and Substance 3D Painter.
• Cisco – patched 3 vulnerabilities with public exploit code in its Identity Services Engine (ISE) and Customer Collaboration Platform (CCP) products.
• Fortinet – security updates for an OS command (‘OS Command Injection’) vulnerability in FortiManager, FortiAnalyzer & FortiAnalyzer-BigData products.
• Google – security updates for Android fix numerous vulnerabilities and an actively exploited Google Chrome zero-day flaw.
• HP – security updates to fix eight vulnerabilities impacting StoreOnce.
• Ivanti – security updates to fix three high-severity hardcoded key vulnerabilities in Workspace Control (IWC).
• Qualcomm – security updates for three zero-day vulnerabilities in the Adreno Graphics Processing Unit (GPU) driver that are exploited in targeted attacks.
• Roundcube – security updates for a critical remote code execution (RCE) flaw with a public exploit that is now exploited in attacks.
• SAP – security updates for multiple products, including a critical missing authorization check in SAP NetWeaver Application Server for ABAP.

FULL LIST OF MICROSOFT PATCHES

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.