Summary:
As part of the February Microsoft Patch Tuesday, Microsoft addressed 55 flaws, including 4 zero-day flaws, two of which are actively being exploited in attacks in the wild. Of the 55 flaws, there was 19 elevation of privilege vulnerabilities, 2 security feature bypass vulnerabilities, 22 remote code execution vulnerabilities, 1 information disclosure vulnerability, 9 denial of service vulnerabilities, and 3 spoofing vulnerabilities. 3 flaws have been rated critical in severity, all of which can lead to remote code execution.

In addition to Microsoft, several other vendors have released updates in February 2024:

• Adobe released security updates for numerous products, including Adobe Photoshop, Substance3D, Illustrator, and Animate.
• AMD released mitigations and firmware updates to address a vulnerability that can be exploited to load malicious CPU microcode.
• Apple released a security update for a zero-day exploited in 'extremely sophisticated' attacks.
• Cisco released security updates for multiple products, including Cisco IOS, ISE, NX-OS, and Identity Services.
• Google fixed an actively exploited zero-day flaw in Android Kernel's USB Video Class driver.
• Ivanti released security updates for Connect Secure, Neurons for MDM, and Cloud Service Application.
• Fortinet released security updates for numerous products, including FortiManager, FortiOS, FortiAnalyzer, and FortiSwitchManager.
• Netgear fixed two critical vulnerabilities affecting multiple WiFi router models.
• SAP releases security updates for multiple products.

Security Officer Comments:
The actively exploited zero-day flaws are being tracked as CVE-2025-21391 and CVE-2025-21418. CVE-2025-21391 pertains to a Windows Storage Elevation of Privilege vulnerability that could enable an actor to remotely delete targeted files on a system. Microsoft notes that the “vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable.”

CVE-2025-2191 on the other hand pertains to a Windows Ancillary Function Driver for WinSock Elevation of Privilege vulnerability. The flaw can be exploited in low-complexity attacks and can be successfully exploited by actors to gain system privileges on targeted devices.

Although Microsoft has confirmed that CVE-2025-21391 and CVE-2025-21418 are being actively exploited in the wild, specific details about these ongoing intrusions have not yet been disclosed.

Suggested Corrections:
Organizations should review the list of vulnerabilities resolved and apply the relevant patches as needed. To access the full list of vulnerabilities addressed, please use the link down below:

https://www.bleepingcomputer.com/mi...ts/Microsoft-Patch-Tuesday-February-2025.html

Link(s):
https://www.bleepingcomputer.com/ne...025-patch-tuesday-fixes-4-zero-days-55-flaws/