Microsoft August 2025 Patch Tuesday fixes 107 flaws, Kerberos zero-day

Microsoft’s August 2025 Patch Tuesday issued a broad set of security updates, addressing 107 distinct vulnerabilities across its product line, including a publicly disclosed zero-day in Windows Kerberos and a slate of 13 critical flaws. The release reinforces the ongoing risk landscape for enterprises relying on Kerberos-based authentication, graphics components, virtualization, Office apps, and cloud services. While Microsoft said no vulnerabilities were actively exploited in the wild at the time of the update, the breadth and severity of the fixes underscore the importance of timely patching across Windows, server, and related software.

A central feature of this cycle is a publicly disclosed zero-day in Windows Kerberos, tracked as CVE202553779, which enables elevation of privilege through a relative path traversal in the Kerberos authentication mechanism. Exploitation could allow an authenticated attacker to gain domain administrator privileges by manipulating delegated credentials stored in managed service accounts. Microsoft’s description highlights that the attacker would need access to certain dMSA attributes to exploit the flaw. Security researchers note that...