November 2025 Patch Tuesday: Microsoft Fixes 63 Vulnerabilities, Including Windows Kernel Zero-Day (CVE-2025-62215)

November 2025 Patch Tuesday saw Microsoft release updates that fix 63 vulnerabilities across Windows, Office, .NET, and developer tools. The rollout includes one zero-day vulnerability that is actively exploited in the wild, CVE-2025-62215, a Windows Kernel elevation of privilege flaw that can allow SYSTEM-level access.

The vulnerabilities are broken down into 29 Elevation of Privilege, 16 Remote Code Execution, 11 Information Disclosure, 3 Denial of Service, 2 Spoofing, and 2 Security Feature Bypass issues, underscoring a continued focus on privilege escalation. Five vulnerabilities were rated Critical, namely CVE-2025-60724 (CVSS 9.8), CVE-2025-30398 (CVSS 8.1), CVE-2025-62199 (CVSS 7.8), CVE-2025-60716 (CVSS 7.0), and CVE-2025-62214 (CVSS 6.7).

According to Microsoft’s advisory, CVE-2025-62215 arises from a race condition in the Windows Kernel, and exploitation has been observed in the wild; the issues were discovered and reported by MSTIC and the MSRC. Security teams should prioritise patching to mitigate risks and reduce exposure across endpoints.