Microsoft Patch Tuesday December 2025: 57 Vulnerabilities, 3 Zero‑Days

Today Microsoft released the Patch Tuesday for December 2025 and (as always) it’s worth paying attention to (and not leaving it “for later”). This update fixes 57 vulnerabilities, including one that’s already being actively exploited and two zero‑days that had been publicly disclosed.

In addition, the update bundle brings fixes for three critical remote code execution (RCE) vulnerabilities — the kind that can become a serious problem if your environment isn’t up to date.

In numbers, here’s how the patched flaws break down by type:

1. 28 privilege elevation

2. 19 remote code execution (RCE)

3. 4 information disclosure

4. 3 denial of service

5. 2 spoofing

Important: this count only considers the patches released by Microsoft in this Patch Tuesday. That’s why it does not include the patches for Microsoft Edge (15 vulnerabilities) nor those for Mariner, which were released earlier this month.

Microsoft Patch Tuesday December 2025

This December 2025 Patch Tuesday arrives with a red‑alert: Microsoft fixed three zero‑day vulnerabilities. For Microsoft, a vulnerability is considered zero‑day when it is publicly disclosed or actively exploited before an official patch is available.

Actively exploited zero‑day: Privilege elevation to SYSTEM level – CVE‑2025‑62221

Microsoft patched a privilege‑elevation flaw in the Windows Cloud Files Mini Filter Driver that was already being used in attacks. In simple terms: the bug allows an attacker with access to the machine to exploit the system to elevate privileges and reach SYSTEM (the highest level in Windows). This type of vulnerability is often essential in attack chains because it turns a “limited” access into full control of the system.

Microsoft credited the discovery to MSTIC (Microsoft Threat Intelligence Center) and MSRC (Microsoft Security Response Center), although they didn’t share public details about the exploitation method.

Publicly disclosed zero‑day – CVE‑2025‑64671

Also fixed was a vulnerability publicly disclosed in GitHub Copilot for JetBrains associated with command injection — which can lead to code execution in the local environment. What’s the real risk? In scenarios where untrusted files are handled or there is interaction with MCP servers, a technique like cross‑prompt injection could push extra commands into the permitted flow — especially if the environment is configured in a way that facilitates execution (for example, auto‑approval in the terminal).

CVE‑2025‑54100 — PowerShell (RCE when using Invoke‑WebRequest)

Read more: Most Exploited Zero-Day Vulnerabilities in 2025

Security Updates: December 2025 Patch Tuesday

Here’s the full list of vulnerabilities Microsoft fixed:

Read more: Patch Management: Why is it essential in IT security?

Our Recommendations from TecnetOne

1. Prioritize patching IT endpoints, admin systems, and critical machines (due to the actively exploited EoP).

2. If you have development teams, validate the update and strengthen practices around untrusted sources and terminal automations.

3. Review automations using PowerShell + Invoke‑WebRequest and apply best practices for consuming web content.