Microsoft Patches Actively Exploited Windows Kernel Zero-Day

Microsoft’s latest Patch Tuesday fixes address more than 60 vulnerabilities across Windows and other products, including a Windows kernel zero-day that has been exploited in unspecified attacks. The zero-day is tracked as CVE-2025-62215 and is described as an important-severity privilege escalation flaw that can grant an attacker System privileges on the targeted device.

According to Microsoft, its Threat Intelligence Center (MSTIC) and Microsoft Security Response Center (MSRC) found CVE-2025-62215, though no details on specific attacks have been disclosed. Four vulnerabilities rated as critical affect Windows, Office, Visual Studio, and Nuance PowerScribe 360, with more than 30 of the fixes exploitable for privilege escalation and 22 enabling remote code execution.

In total, the updates patch vulnerabilities across Windows, Visual Studio, Azure Monitor Agent, Configuration Manager, Dynamics 365, Office, OneDrive, SharePoint, and Edge. 11 November 2025