Microsoft Fixes 111 Flaws in August 2025 Patch Tuesday

Microsoft published its monthly security update, part of its Patch Tuesday initiative, on August 12, fixing a total of 111 security flaws, including one publicly disclosed zero-day vulnerability in Windows Kerberos.

According to Microsoft’s report, the 111 Common Vulnerabilities and Exposures (CVEs) spanned across multiple categories and severity levels. Of the 36 Remote Code Execution (RCE) vulnerabilities — the most common threat classification — 10 were rated critical, including the Remote Desktop Spoofing Vulnerability in the Microsoft Graphics Component, rated 9.8. Other critical RCE vulnerabilities affected Microsoft Office, which could pose risks to remote teams.

The update also addressed a Windows Kerberos vulnerability, CVE-2025-53779, a zero-day previously discovered by security researcher Yuval Gordon at Akamai, which allowed unauthorized users to elevate privileges on a network.

According to The Hacker News, the Windows Kerberos flaw was publicly disclosed by Gordon in May and was nicknamed “BadSuccessor.” The vulnerability enabled threat actors to misuse delegated Managed Service Account (dMSA) objects and compromise an Active Directory (AD) domain.

"The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act," said Adam Barnett, lead software engineer at Rapid7, in an interview with The Hacker News.

Microsoft’s August report also included two vulnerabilities affecting Edge on Android devices — spoofing bugs — and 16 affecting Microsoft's Chromium-based Edge browser. The document additionally covered 18 information disclosure flaws, 4 denial-of-service vulnerabilities, and a total of 8 spoofing cases.

Last month, researchers at Oasis Security unveiled a flaw in Microsoft’s OneDrive File Picker, which allowed popular external apps, such as ChatGPT, Zoom, Trello, and Slack, to gain access to users’ content on OneDrive.