Microsoft's security release of 10 June 2025
Patch Tuesday, June 2025
As of , CISA lists two of the 64 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-33053, Internet Shortcut Files Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2025-33053Internet Shortcut Files Remote Code Execution. Listed by CISA on 10 June 2025, release day
- CVE-2025-33073Windows SMB Client Elevation of Privilege. Listed by CISA on 20 October 2025, 132 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 64 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 62 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | 6 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-33053Internet Shortcut Files Remote Code Execution | Active | Patch this weekListed | 8.8 High | 0.87 |
| 2 | CVE-2025-33073Windows SMB Client Elevation of Privilege | Active | Patch this weekListed | 8.8 High | 0.83 |
| 3 | CVE-2025-33071Windows KDC Proxy Service (KPSSVC) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.23 |
| 4 | CVE-2025-47166Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.21 |
| 5 | CVE-2025-47163Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.20 |
| 6 | CVE-2025-33070Windows Netlogon Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.10 |
| 7 | CVE-2025-47172Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 8 | CVE-2025-47165Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 9 | CVE-2025-47175Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 10 | CVE-2025-47962Windows SDK Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 11 | CVE-2025-32724Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 12 | CVE-2025-32725DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 13 | CVE-2025-33050DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 14 | CVE-2025-33056Windows Local Security Authority (LSA) Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 15 | CVE-2025-33068Windows Standards-Based Storage Management Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 16 | CVE-2025-47171Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.02 |
| 17 | CVE-2025-33057Windows Local Security Authority (LSA) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 18 | CVE-2025-33064Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2025-33066Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2025-32717Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 21 | CVE-2025-47162Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 22 | CVE-2025-47164Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 23 | CVE-2025-47167Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 24 | CVE-2025-47953Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 25 | CVE-2025-47957Microsoft Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 26 | CVE-2025-47977Nuance Digital Engagement Platform Spoofing | None | Not on CISA's list | 8.2 High | 0.01 |
| 27 | CVE-2025-29828Windows Schannel Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 28 | CVE-2025-32710Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 29 | CVE-2025-32713Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2025-32714Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2025-33075Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2025-47168Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-47169Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2025-47170Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2025-47173Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 36 | CVE-2025-47176Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 37 | CVE-2025-47955Windows Remote Access Connection Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 38 | CVE-2025-32721Windows Recovery Driver Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 39 | CVE-2025-32715Remote Desktop Protocol Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 40 | CVE-2025-24065Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 41 | CVE-2025-24068Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 42 | CVE-2025-24069Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 43 | CVE-2025-32719Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 44 | CVE-2025-32720Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 45 | CVE-2025-32722Windows Storage Port Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 46 | CVE-2025-33052Windows DWM Core Library Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 47 | CVE-2025-33055Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 48 | CVE-2025-33058Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 49 | CVE-2025-33059Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 50 | CVE-2025-33060Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 51 | CVE-2025-33061Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 52 | CVE-2025-33062Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 53 | CVE-2025-33063Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 54 | CVE-2025-33065Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 55 | CVE-2025-47956Windows Security App Spoofing | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 56 | CVE-2025-47160Windows Shortcut Files Security Feature Bypass | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 57 | CVE-2025-47969Windows Virtualization-Based Security (VBS) Information Disclosure | None | Not on CISA's list | 4.4 Medium | 0.01 |
| 58 | CVE-2025-33067Windows Task Scheduler Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 59 | CVE-2025-32712Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 60 | CVE-2025-32716Windows Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 61 | CVE-2025-32718Windows SMB Client Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 62 | CVE-2025-47174Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 63 | CVE-2025-47968Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 64 | CVE-2025-33069Windows App Control for Business Security Feature Bypass | None | Not on CISA's list | 5.1 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 10 June 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.