Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click Bugs

Microsoft’s November security update, while slimmer than October’s record patch-out, still tackles a set of high-priority flaws across Windows components, including a zero-day actively exploited in the Windows Kernel that allows privilege escalation to admin-level rights (CVE-2025-62215, CVSS 7.5).

The update also includes a critical RCE flaw in the GDI+ Windows graphics component (CVE-2025-60724, CVSS 9.8) that Microsoft says could enable arbitrary code execution or data theft without user involvement when a malignant metafile is uploaded to Web services; this patch should be a organisation’s highest priority, according to Ben McCarthy of Immersive.

Other notable fixes address a medium-severity elevation‑of‑privilege bug in Windows Kerberos (CVE-2025-60704, CVSS 7.5), dubbed CheckSum by Silverfort, which could permit privilege escalation and lateral movement if Active Directory Kerberos delegation is enabled. Also flagged are vulnerabilities in Windows Subsystem for Linux GUI (CVE-2025-62220, CVSS 8.8) and several other 7.0‑severity issues (CVE-2025-60719, 62213, 62217) that enable privilege escalation, all part of a 63‑CVE‑strong November list.

According to Microsoft, the November rollout includes one actively exploited flaw, five likely to be targeted, and the single critical vulnerability, with the usual mix of privilege escalation, remote code execution, information disclosure and DoS issues. The patch cycle comes as security researchers and practitioners cautioned that even mid‑severity bugs can pose broad enterprise risks, with experts emphasising rapid application of updates.