Microsoft Patches 67 Vulnerabilities Together with WEBDAV Zero-Day Exploited within the Wild

Thank you for reading this post, don't forget to subscribe!

Microsoft has launched patches to repair 67 safety flaws, together with one zero-day bug in Internet Distributed Authoring and Versioning (WEBDAV) that it mentioned has come beneath energetic exploitation within the wild.

Of the 67 vulnerabilities, 11 are rated Crucial and 56 are rated Essential in severity. This consists of 26 distant code execution flaws, 17 data disclosure flaws, and 14 privilege escalation flaws.

The patches are along with 13 shortcomings addressed by the corporate in its Chromium-based Edge browser for the reason that launch of final month’s Patch Tuesday replace.

The vulnerability that has been weaponized in real-world assaults considerations a distant code execution in WEBDAV (CVE-2025-33053, CVSS rating: 8.8) that may be triggered by deceiving customers into clicking on a specifically crafted URL.

The tech big credited Examine Level researchers Alexandra Gofman and David Driker for locating and reporting the bug. It is price mentioning that CVE-2025-33053 is the primary zero-day vulnerability to be disclosed within the WebDAV normal.

In a separate report, the cybersecurity firm attributed the abuse of CVE-2025-33053 to a menace actor generally known as Stealth Falcon (aka FruityArmor), which has a historical past of leveraging Home windows zero-days in its assaults. In September 2023, the hacking group was noticed utilizing a backdoor dubbed Deadglyph as a part of an espionage marketing campaign aimed toward entities in Qatar and Saudi Arabia.

“The assault used a .url file that exploited a zero-day vulnerability (CVE-2025-33053) to execute malware from an actor-controlled WebDAV server,” Examine Level mentioned. “CVE-2025-33053 permits distant code execution by means of manipulation of the working listing.”

Within the assault chain noticed towards an unnamed protection firm in Turkey, the menace actor is claimed to have employed CVE-2025-33053 to ship Horus Agent, a {custom} implant constructed for the Mythic command-and-control (C2) framework. It is believed that the malicious payload used to provoke the assault, a URL shortcut file, was despatched as an archived attachment in a phishing electronic mail.

The URL file is used to launch iediagcmd.exe, a official diagnostics utility for Web Explorer, leveraging it to launch one other payload referred to as Horus Loader, which is answerable for serving a decoy PDF doc and executing Horus Agent.

“Written in C++, the implant exhibits no important overlap with identified C-based Mythic brokers, other than commonalities within the generic logic associated to Mythic C2 communications,” Examine Level mentioned. “Whereas the loader makes positive to implement some measures to guard the payload, the menace actors positioned extra precautions throughout the backdoor itself.”

This consists of the usage of strategies like string encryption and management circulate flattening to complicate evaluation efforts. The backdoor then connects to a distant server to fetch duties that permit it to gather system data, enumerate information and folders, obtain information from the server, inject shellcode into working processes, and exit this system.

CVE-2025-33053 an infection chain

Horus Agent is assessed to be an evolution of the personalized Apollo implant, an open-source .NET agent for Mythic framework, that was beforehand put to make use of by Stealth Falcon between 2022 and 2023.

“Horus is a extra superior model of the menace teams’ {custom} Apollo implant, rewritten in C++, improved, and refactored,” Examine Level mentioned.

“Much like the Horus model, the Apollo model introduces in depth sufferer fingerprinting capabilities whereas limiting the variety of supported instructions. This enables the menace actors to give attention to stealthy identification of the contaminated machine and subsequent stage payload supply, whereas additionally conserving the implant measurement considerably smaller (solely 120Kb) than the total agent.”

The corporate mentioned it additionally noticed the menace actor leveraging a number of beforehand undocumented instruments comparable to the next –

Credential Dumper, which targets an already-compromised Area Controller to steal Lively Listing and Area Controller credential-related information
Passive backdoor, which listens for incoming requests and executes shellcode payloads
Keylogger, a {custom} C++ device that information all keystrokes and writes them to a file beneath “C:/home windows/temp/~TNpercentLogName%.tmp”

The keylogger notably lacks any C2 mechanism, which means that it possible works at the side of one other element that may exfiltrate the file to the attackers.

“Stealth Falcon employs business code obfuscation and safety instruments, in addition to custom-modified variations tailor-made for various payload sorts,” the Examine Level mentioned. “This makes their instruments harder to reverse-engineer and complicates monitoring technical adjustments over time.”

The energetic exploitation of CVE-2025-33053 has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) to add it to the Identified Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Govt Department (FCEB) businesses to use the repair by July 1, 2025.

“What makes this flaw significantly regarding is the widespread use of WebDAV in enterprise environments for distant file sharing and collaboration,” Mike Walters, President and Co-Founding father of Action1, mentioned. “Many organizations allow WebDAV for official enterprise wants — usually with out absolutely understanding the safety dangers it introduces.”

Essentially the most extreme vulnerability resolved by Microsoft is a privilege escalation flaw in Energy Automate (CVE-2025-47966, CVSS rating: 9.8) that might allow an attacker to raise privileges over a community. Nonetheless, there isn’t any buyer motion required to mitigate the bug.

Different vulnerabilities of observe embody elevation of privilege flaws in Widespread Log File System Driver (CVE-2025-32713, CVSS rating: 7.8), Home windows Netlogon (CVE-2025-33070, CVSS rating: 8.1), and Home windows SMB Shopper (CVE-2025-33073, CVSS rating: 8.8), in addition to a essential unauthenticated RCE vulnerability within the Home windows KDC Proxy Service (CVE-2025-33071, CVSS rating: 8.1).

“Over the previous a number of months, the CLFS driver has change into a constant focus for each menace actors and safety researchers as a result of its exploitation in a number of ransomware operations,” Ben McCarthy, lead cyber safety engineer at Immersive mentioned.

“It’s categorized as a heap-based buffer overflow — a sort of reminiscence corruption vulnerability. The assault complexity is taken into account low, and profitable exploitation permits an attacker to escalate privileges.”

Adam Barnett, lead software program engineer at Rapid7, mentioned the exploitation of CVE-2025-33071 requires the attacker to use a cryptographic flaw and win a race situation.

“The unhealthy information is that Microsoft considers exploitation extra possible regardless, and since a KDC proxy helps Kerberos requests from untrusted networks extra simply entry trusted property with none want for a direct TCP connection from the shopper to the area controller, the trade-off right here is that the KDC proxy itself is sort of more likely to be uncovered to an untrusted community,” Barnett added.

Final however not least, Microsoft has additionally rolled out patches to remediate a safe boot bypass bug (CVE-2025-3052, CVSS rating: 6.7) found by Binarly that allows the execution of untrusted software program.

“A vulnerability exists in a UEFI utility signed with a Microsoft third-party UEFI certificates, which permits an attacker to bypass UEFI Safe Boot,” Redmond mentioned in an alert. “An attacker who efficiently exploited this vulnerability may bypass Safe Boot.”

CERT Coordination Heart (CERT/CC), in an advisory launched Tuesday, mentioned the vulnerability is rooted in Unified Extensible Firmware Interface (UEFI) functions DTBios and BiosFlashShell from DT Analysis, permitting Safe Boot bypass utilizing a specifically crafted NVRAM variable.

“The vulnerability stems from improper dealing with of a runtime NVRAM variable that allows an arbitrary write primitive, able to modifying essential firmware buildings, together with the worldwide Security2 Architectural Protocol used for Safe Boot verification,” CERT/CC mentioned.

“As a result of the affected functions are signed by the Microsoft UEFI Certificates Authority, this vulnerability may be exploited on any UEFI-compliant system, permitting unsigned code to run in the course of the boot course of.”

Profitable exploitation of the vulnerability may allow the execution of unsigned or malicious code even earlier than the working system masses, doubtlessly enabling attackers to drop persistent malware that may survive reboots and even disable safety software program.

Microsoft, nonetheless, shouldn’t be affected by CVE-2025-4275 (aka Hydroph0bia), one other Safe Boot bypass vulnerability current in an InsydeH2O UEFI utility that permits digital certificates injection by means of an unprotected NVRAM variable (“SecureFlashCertData”), leading to arbitrary code execution on the firmware stage.

“This difficulty arises from the unsafe use of an NVRAM variable, which is used as trusted storage for a digital certificates within the belief validation chain,” CERT/CC mentioned. “An attacker can retailer their very own certificates on this variable and subsequently run arbitrary firmware (signed by the injected certificates) in the course of the early boot course of throughout the UEFI surroundings.”

Software program Patches from Different Distributors

Along with Microsoft, safety updates have additionally been launched by different distributors over the previous few weeks to rectify a number of vulnerabilities, together with —