Microsoft's security release of 9 December 2025
Patch Tuesday, December 2025
As of , CISA lists one of the 56 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-62221, Windows Cloud Files Mini Filter Driver Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege. Listed by CISA on 9 December 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 56 CVEs |
| On CISA's list of exploited vulnerabilities | 1 CVE |
| CISA's SSVC exploitation: active | 1 CVE |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 55 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.03 |
| 2 | CVE-2025-54100PowerShell Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 3 | CVE-2025-59516Windows Storage VSP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 4 | CVE-2025-59517Windows Storage VSP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 5 | CVE-2025-62454Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 6 | CVE-2025-62472Windows Remote Access Connection Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 7 | CVE-2025-62456Windows Resilient File System (ReFS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 8 | CVE-2025-62549Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 9 | CVE-2025-62550Azure Monitor Agent Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 10 | CVE-2025-64672Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 8.8 High | 0.01 |
| 11 | CVE-2025-64678Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 12 | CVE-2025-62458Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 13 | CVE-2025-62470Windows Common Log File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 14 | CVE-2025-62552Microsoft Access Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 15 | CVE-2025-62553Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 16 | CVE-2025-62556Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 17 | CVE-2025-62558Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 18 | CVE-2025-62559Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 19 | CVE-2025-62560Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 20 | CVE-2025-62561Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 21 | CVE-2025-62562Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 22 | CVE-2025-62563Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2025-62564Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2025-64666Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 25 | CVE-2025-62565Windows File Explorer Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 26 | CVE-2025-62555Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.01 |
| 27 | CVE-2025-62473Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 28 | CVE-2025-64670Windows DirectX Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 29 | CVE-2025-62468Windows Defender Firewall Service Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 30 | CVE-2025-62567Windows Hyper-V Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 31 | CVE-2025-64667Microsoft Exchange Server Spoofing | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 32 | CVE-2025-62554Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 33 | CVE-2025-62557Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 34 | CVE-2025-64671GitHub Copilot for Jetbrains Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 35 | CVE-2025-55233Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 36 | CVE-2025-62455Microsoft Message Queuing (MSMQ) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 37 | CVE-2025-62457Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 38 | CVE-2025-62461Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 39 | CVE-2025-62462Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 40 | CVE-2025-62464Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 41 | CVE-2025-62466Windows Client-Side Caching Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 42 | CVE-2025-62467Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 43 | CVE-2025-62474Windows Remote Access Connection Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 44 | CVE-2025-62571Windows Installer Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 45 | CVE-2025-62572Application Information Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 46 | CVE-2025-64661Windows Shell Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2025-64673Windows Storage VSP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2025-64679Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 49 | CVE-2025-64680Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 50 | CVE-2025-64658Windows File Explorer Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.00 |
| 51 | CVE-2025-62570Windows Camera Frame Server Monitor Information Disclosure | None | Not on CISA's list | 7.1 High | 0.00 |
| 52 | CVE-2025-62469Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 53 | CVE-2025-62569Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 54 | CVE-2025-62573DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 55 | CVE-2025-62463DirectX Graphics Kernel Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.00 |
| 56 | CVE-2025-62465DirectX Graphics Kernel Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 9 December 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.