In the last Patch Tuesday for 2025, Microsoft addresses 56 CVEs, including two publicly disclosed vulnerabilities and one zero-day that was exploited in the wild. Elevation of privilege (EoP) vulnerabilities accounted for 50% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 33.9%. Please find below a comment from Satnam Narang, Senior Staff Research Engineer at Tenable and full analysis of this month’s Patch Tuesday in this blog.

“Microsoft closed out 2025 with one of its smallest releases for Patch Tuesday, patching 55 CVEs, matching the lowest total from February of this year. Despite the low volume the last few months, Microsoft patched a whopping 1,129 CVEs in 2025, an 11.9% increase from 2024 and the second largest Patch Tuesday release ever. This year marks the second consecutive year that Microsoft patched over one thousand CVEs, the third time it has done so since its inception. 

“Two vulnerabilities caught my eye this month. The first is CVE-2025-62221, an elevation of privilege vulnerability in Windows Cloud Files Mini Filter Driver (cldflt.sys) that was exploited in the wild as a zero day. Elevation of privilege bugs turn a foothold into a full breach as attackers often use them to conduct post-compromise activity after they have gained initial access through other means, such as social engineering or exploitation of another flaw. Windows Cloud Files Mini Filter Driver is an attractive target because it is a file system driver that enables cloud applications to access file system functionalities. 

 “The second vulnerability exposes a critical and growing attack surface: AI Agents embedded into IDEs as part of an attack chain that leverages prompt injections against these tools to access the base IDE layer, which can result in information disclosure or command execution. CVE-2025-64671 is a remote code execution vulnerability in the GitHub Copilot Plugin for JetBrains IDEs. This flaw appears to be one of several associated with an underlying flaw across multiple IDEs, including GitHub Copilot, Cursor, JetBrains Junie, Roo Code and Claude Code. This is not an isolated incident; it’s part of a broader, systemic security crisis that security researcher Ari Marzuk has branded “IDEsaster.”” — Satnam Narang, Senior Staff Research Engineer at Tenable