Patch Tuesday August 2025: Microsoft Fixes 107 Vulnerabilities

Today is Patch Tuesday, and Microsoft is coming in with a security-heavy update. In this August 2025 Patch Tuesday, the company has released fixes for 107 security flaws, including a zero-day vulnerability in Windows Kerberos that had already been publicly disclosed.

But that’s not all: among these fixes, 13 vulnerabilities are classified as critical. Of those:

1. 9 are remote code execution vulnerabilities (the most dangerous, as they allow an attacker to run malicious software without your permission).

2. 3 are information disclosure vulnerabilities.

3. 1 is a privilege escalation vulnerability.

Looking at the bigger picture, the flaws break down as follows:

1. 44 privilege escalation vulnerabilities.

2. 35 remote code execution vulnerabilities.

3. 18 information disclosure vulnerabilities.

4. 4 denial of service vulnerabilities.

5. 9 spoofing vulnerabilities.

It’s important to note that this count only includes the updates released today as part of Patch Tuesday. It does not include fixes Microsoft had already released earlier this month for other products such as Mariner, Azure, or Microsoft Edge.

In short: this is not the month to postpone updates. Especially with a zero-day in play, every day without installing patches is an opportunity for attackers to find a hole in your system.

A zero-day vulnerability that can’t be ignored

This month’s Patch Tuesday has a clear headline act: the fix for a zero-day vulnerability in Windows Kerberos, already publicly disclosed and posing a serious risk to enterprise networks.

To put it simply: Microsoft considers a “zero-day” to be a flaw that has already been disclosed or exploited before an official patch is available. In this case, we’re talking about CVE-2025-53779, a privilege escalation flaw that allowed an authenticated attacker to gain domain administrator rights.

Microsoft explained that the issue was due to a relative path traversal within Windows Kerberos. With this flaw, someone with valid credentials could exploit it to escalate privileges on the network and take control of critical resources.

The attack required advanced access to two managed account attributes (dMSA):

1. msds-groupMSAMembership → Allows the user to use the dMSA.

2. msds-ManagedAccountPrecededByLink → If the attacker has write permission here, they can specify a user on whose behalf the dMSA will act.

In plain terms: if you manage Windows networks and haven’t applied this patch yet, you’re leaving a door wide open for anyone with internal access to become the absolute ruler of your domain.

Read more: What is patch management?

August 2025 Patch Tuesday Security Updates

Read more: +29,000 Servidores Exchange Siguen Vulnerables a una Falla Crítica

Conclusion

At TecnetOne, we believe cybersecurity is not something you can put off until tomorrow. Every patch Microsoft releases is another barrier between your systems and attackers, and in a month like this— with over a hundred vulnerabilities fixed and an active zero-day—speed in applying updates is key.

Our recommendation is clear: install the patches immediately, verify they’ve been applied correctly, and maintain a consistent update plan. This not only protects your information but also ensures business continuity and preserves your customers’ trust.