Microsoft's security release of 11 November 2025
Patch Tuesday, November 2025
As of , CISA lists two of the 63 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-60710, Host Process for Windows Tasks Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege. Listed by CISA on 13 April 2026, 153 days after the release
- CVE-2025-62215Windows Kernel Elevation of Privilege. Listed by CISA on 12 November 2025, 1 day after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 63 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 61 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege | Active | Patch nowListed | 7.8 High | 0.05 |
| 2 | CVE-2025-62215Windows Kernel Elevation of Privilege | Active | Patch soonListed | 7.0 High | 0.06 |
| 3 | CVE-2025-60724GDI+ Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.06 |
| 4 | CVE-2025-59512Customer Experience Improvement Program (CEIP) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 5 | CVE-2025-62204Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.02 |
| 6 | CVE-2025-60705Windows Client-Side Caching Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 7 | CVE-2025-60719Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.02 |
| 8 | CVE-2025-62213Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.02 |
| 9 | CVE-2025-59499Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 10 | CVE-2025-62220Windows Subsystem for Linux GUI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 11 | CVE-2025-62222Agentic AI and Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 12 | CVE-2025-62210Dynamics 365 Field Service (online) Spoofing | None | Not on CISA's list | 8.7 High | 0.01 |
| 13 | CVE-2025-62211Dynamics 365 Field Service (online) Spoofing | None | Not on CISA's list | 8.7 High | 0.01 |
| 14 | CVE-2025-30398Nuance PowerScribe 360 Information Disclosure | None | Not on CISA's list | 8.1 High | 0.01 |
| 15 | CVE-2025-60715Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 16 | CVE-2025-62452Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 17 | CVE-2025-60714Windows OLE Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 18 | CVE-2025-60727Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 19 | CVE-2025-62199Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 20 | CVE-2025-62203Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 21 | CVE-2025-60704Windows Kerberos Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 22 | CVE-2025-60726Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 23 | CVE-2025-62202Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 24 | CVE-2025-62214Visual Studio Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.01 |
| 25 | CVE-2025-60722Microsoft OneDrive for Android Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 26 | CVE-2025-62206Microsoft Dynamics 365 (On-Premises) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 27 | CVE-2025-60723DirectX Graphics Kernel Denial of Service | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 28 | CVE-2025-59240Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 29 | CVE-2025-59509Windows Speech Recognition Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 30 | CVE-2025-59510Windows Routing and Remote Access Service (RRAS) Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 31 | CVE-2025-62208Windows License Manager Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 32 | CVE-2025-62209Windows License Manager Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 33 | CVE-2025-60728Microsoft Excel Information Disclosure | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 34 | CVE-2025-59505Windows Smart Card Reader Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 35 | CVE-2025-59511Windows WLAN Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 36 | CVE-2025-59514Microsoft Streaming Service Proxy Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 37 | CVE-2025-60703Windows Remote Desktop Services Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 38 | CVE-2025-60707Multimedia Class Scheduler Service (MMCSS) Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 39 | CVE-2025-60709Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 40 | CVE-2025-60713Windows Routing and Remote Access Service (RRAS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 41 | CVE-2025-60718Windows Administrator Protection Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 42 | CVE-2025-60720Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 43 | CVE-2025-60721Windows Administrator Protection Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 44 | CVE-2025-62200Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 45 | CVE-2025-62201Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 46 | CVE-2025-62205Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2025-62216Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2025-59504Azure Monitor Agent Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.00 |
| 49 | CVE-2025-59506DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 50 | CVE-2025-59507Windows Speech Runtime Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 51 | CVE-2025-59508Windows Speech Recognition Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 52 | CVE-2025-59515Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 53 | CVE-2025-60716DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 54 | CVE-2025-60717Windows Broadcast DVR User Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 55 | CVE-2025-62217Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 56 | CVE-2025-62218Microsoft Wireless Provisioning System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 57 | CVE-2025-62219Microsoft Wireless Provisioning System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 58 | CVE-2025-62449Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 59 | CVE-2025-47179Configuration Manager Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 60 | CVE-2025-60708Storvsp.sys Driver Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.00 |
| 61 | CVE-2025-59513Windows Bluetooth RFCOM Protocol Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.00 |
| 62 | CVE-2025-60706Windows Hyper-V Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.00 |
| 63 | CVE-2025-62453GitHub Copilot and Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 5.0 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 November 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.