Microsoft August 2025 Patch Tuesday fixes one zero-day, 107 flaws

Today is Microsoft's August 2025 Patch Tuesday, which includes security updates for 107 flaws, including one publicly disclosed zero-day vulnerability in Windows Kerberos.

This Patch Tuesday also fixes thirteen "Critical" vulnerabilities, nine of which are remote code execution vulnerabilities, three are information disclosure, and one is elevation of privileges.

The number of bugs in each vulnerability category is listed below:

• 44 Elevation of Privilege Vulnerabilities
• 35 Remote Code Execution Vulnerabilities
• 18 Information Disclosure Vulnerabilities
• 4 Denial of Service Vulnerabilities
• 9 Spoofing Vulnerabilities

When BleepingComputer reports on the Patch Tuesday security updates, we only count those released on Patch Tuesday. Therefore, the number of flaws does not include Mariner, Azure, and Microsoft Edge bugs fixed earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5063878 & KB5063875 cumulative updates and the Windows 10 KB5063709 cumulative update.

One publicly disclosed zero-day fixed

This month's Patch Tuesday fixes one publicly disclosed zero-day in Microsoft SQL Server. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The publicly disclosed zero-day is:

CVE-2025-53779 - Windows Kerberos Elevation of Privilege Vulnerability

Microsoft fixes a flaw in Windows Kerberos that allows an authenticated attacker to gain domain administrator privileges.

"Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network," explains Microsoft.

Microsoft says that an attacker would need to have elevated access to the following dMSA attributes to exploit the flaw:

• msds-groupMSAMembership: This attribute allows the user to utilize the dMSA.
• msds-ManagedAccountPrecededByLink: The attacker needs write access to this attribute, which allows them to specify a user that the dMSA can act on behalf of.

Microsoft attributes the discovery of this flaw to Yuval Gordon of Akamai, who published a technical report on the flaw in May.

Recent updates from other companies

Other vendors who released updates or advisories in July 2025 include:

• 7-Zip released a security update for a path traversal flaw that could lead to RCE.
• Adobe released emergency updates for AEM Forms zero-days after PoCs were released.
• Cisco released patches for WebEx and Identity Services Engine.
• Fortinet released security updates today for multiple products, including FortiOS, FortiManager, FortiSandbox, and FortiProxy.
• Google released security updates for Android that fix two actively exploited Qualcomm vulnerabilities.
• Microsoft warned about a Microsoft Exchange flaw tracked as CVE-2025-53786 that could be used to hijack cloud environments.
• Proton fixed a bug in its new Authenticator app for iOS that logged users' sensitive TOTP secrets in plaintext.
• SAP released the July security updates for multiple products, including numerous vulnerabilities with a 9.9 rating.
• Trend Micro released a "fix tool" for an actively exploited remote code execution vulnerability in Apex One. Full security updates will come at a later date.
• WinRAR released a security update at the end of July for an actively exploited path traversal bug that could lead to remote code execution.

The August 2025 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the July 2025 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses

Windows 11 KB5063878 & KB5063875 cumulative updates released