{"id":37623,"date":"2025-04-09T01:44:54","date_gmt":"2025-04-08T23:44:54","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=37623"},"modified":"2025-04-10T01:44:08","modified_gmt":"2025-04-09T23:44:08","slug":"microsoft-security-update-summary-april-8-2025","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2025\/04\/09\/microsoft-security-update-summary-april-8-2025\/","title":{"rendered":"Microsoft Security Update Summary (April 8, 2025)"},"content":{"rendered":"<p><img decoding=\"async\" style=\"margin: 0px 10px 0px 0px;\" title=\"Update\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2021\/06\/Update-01.jpg\" alt=\"Update\" align=\"left\" border=\"0\" \/>[<a href=\"https:\/\/www.borncity.com\/blog\/2025\/04\/09\/microsoft-security-update-summary-8-april-2025\/\" target=\"_blank\" rel=\"noopener\">Germany<\/a>]Microsoft released security updates for Windows clients and servers, Office and other products on April 8, 2025. The security updates eliminate 121 vulnerabilities (CVEs), one of which was classified as 0-day. This vulnerability has already been attacked. Below is a compact overview of these updates that were released on Patchday.<\/p>\n<p><!--more--><\/p>\n<h2>Notes on the updates<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/vg06.met.vgwort.de\/na\/0044a4c81be249188eb1a2c6dbcbccb7\" alt=\"\" width=\"1\" height=\"1\" \/>A list of the updates can be found on <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-us\" target=\"_blank\" rel=\"noopener\">this Microsoft page<\/a>. Details on the update packages for Windows, Office etc. are available in separate blog posts.<\/p>\n<p>All Windows 10\/11 updates (as well as the updates of the server counterparts) are cumulative. The monthly patchday update contains all security fixes for these Windows versions &#8211; as well as all non-security fixes up to the patchday. In addition to the security patches for the vulnerabilities, the updates also contain fixes to correct errors or new features.<\/p>\n<h3>Windows Server 2012 R2<\/h3>\n<p>An ESU license is required for Windows Server 2012 \/R2 to receive further security updates (<a href=\"https:\/\/borncity.com\/win\/2023\/11\/11\/windows-server-2012-r2-gets-extended-security-updates-esu-until-october-2026\/\">Windows Server 2012\/R2 gets Extended Security Updates (ESU) until October 2026<\/a>).<\/p>\n<h2>Fixed vulnerabilities<\/h2>\n<p>Tenable has published <a href=\"https:\/\/www.tenable.com\/blog\/microsofts-april-2025-patch-tuesday-addresses-121-cves-cve-2025-29824\" target=\"_blank\" rel=\"noopener\">this blog post<\/a> with an overview of the vulnerabilities that have been fixed. Here are some of the critical vulnerabilities that have been fixed:<\/p>\n<ul>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-29824\" target=\"_blank\" rel=\"noopener\">CVE-2025-29824<\/a>: Windows Common Log File System Driver Elevation of Privilege vulnerability, CVEv3 Score 7.8, important; the 0-day vulnerability was exploited in the wild. Microsoft discovered this vulnerability in ransomware distributed by the PipeMagic malware via the Storm-2460 group.<\/li>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-26671\" target=\"_blank\" rel=\"noopener\">CVE-2025-26671<\/a>,\u00a0<a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-27482\" target=\"_blank\" rel=\"noopener\">CVE-2025-27482<\/a>, <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-27480\" target=\"_blank\" rel=\"noopener\">CVE-2025-27480<\/a>: Windows Remote Desktop Services Remote Code Execution vulnerabilities, CVEv3 Score 8.1, two critical, CVE-2025-26671 important; To exploit these vulnerabilities, an attacker must be able to gain a race condition. Despite this requirement, Microsoft categorized CVE-2025-27482 and CVE-2025-27480 as \"Exploitation More Likely\" according to Microsoft's Exploitability Index. Microsoft has also fixed an RCE vulnerability in Remote Desktop Client (CVE-2025-27487).<\/li>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-26663\" target=\"_blank\" rel=\"noopener\">CVE-2025-26663<\/a>, <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-26670\" target=\"_blank\" rel=\"noopener\">CVE-2025-26670<\/a>: Multiple Lightweight Directory Access Protocol (LDAP) Remote Code Execution vulnerabilities, CVEv3 Score 8.1, critical; Successful exploitation of these two vulnerabilities requires the exploitation of a race condition via a specially crafted request that leads to a Use After Free. If this succeeds, the attacker can reach an RCE on an affected host. Microsoft rates the vulnerabilities as \"Exploitation More Likely\". Microsoft has also patched CVE-2025-26673 and CVE-2025-27469, two Denial of Service (DoS) vulnerabilities in LDAP. These have been rated as important and \"Exploitation Less Likely\".<\/li>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-27740\" target=\"_blank\" rel=\"noopener\">CVE-2025-27740<\/a>: Active Directory Certificate Services Elevation of Privilege vulnerability, CVEv3 Score 8.8, important; According to Microsoft, if this vulnerability is successfully exploited, an attacker can gain domain administrator privileges by manipulating computer accounts. This vulnerability is classified as \"Exploitation less likely\".<\/li>\n<li><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-29793\" target=\"_blank\" rel=\"noopener\">CVE-2025-29793<\/a>, <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/en-US\/vulnerability\/CVE-2025-29794\" target=\"_blank\" rel=\"noopener\">CVE-2025-29794<\/a>: Microsoft SharePoint Remote Code Execution vulnerability, CVEv3 Score 8.8, important; If successfully exploited, an attacker could execute arbitrary code. According to Microsoft, an attacker must be authenticated to exploit this vulnerability.<\/li>\n<\/ul>\n<p>A list of all discovered CVEs can be found on <a href=\"https:\/\/msrc.microsoft.com\/update-guide\/\" target=\"_blank\" rel=\"noopener\">this Microsoft page<\/a>, excerpts are available at <a href=\"https:\/\/www.tenable.com\/blog\/microsofts-april-2025-patch-tuesday-addresses-121-cves-cve-2025-29824\" target=\"_blank\" rel=\"noopener\">Tenable<\/a>.<\/p>\n<p><strong>Similar articles:<\/strong><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/microsoft-security-update-summary-april-8-2025\/\">Microsoft Security Update Summary (April 8, 2025)<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/patchday-windows-10-11-updates-april-8-2025\/\">Patchday: Windows 10\/11 Updates (April 8, 2025)<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/patchday-windows-server-updates-8-april-2025\/\">Patchday: Windows Server-Updates (April 8, 2025)<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2025\/04\/10\/patchday-microsoft-office-updates-april-8-2025\/\">Patchday: Microsoft Office Updates (April 8, 2025)<\/a><\/p>\n<p><a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/word-excel-2016-crashing-after-april-2025-update-kb5002700\/\">Word\/Excel 2016 crashing after April 2025 update KB5002700<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/outlook-2016-calendar-access-blocked-after-april-2025-update-kb5002700\/\" rel=\"bookmark\">Outlook 2016: Calendar access blocked after April 2025 update KB5002700<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[Germany]Microsoft released security updates for Windows clients and servers, Office and other products on April 8, 2025. The security updates eliminate 121 vulnerabilities (CVEs), one of which was classified as 0-day. This vulnerability has already been attacked. Below is a &hellip; <a href=\"https:\/\/borncity.com\/win\/2025\/04\/09\/microsoft-security-update-summary-april-8-2025\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,580,2],"tags":[125,2906,69,195,194],"class_list":["post-37623","post","type-post","status-publish","format-standard","hentry","category-office","category-security","category-windows","tag-office","tag-patchday-4-2025","tag-security","tag-update","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/37623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=37623"}],"version-history":[{"count":5,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/37623\/revisions"}],"predecessor-version":[{"id":37667,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/37623\/revisions\/37667"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=37623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=37623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=37623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}