Microsoft just patched a host of worrying security issues, so update now

• Microsoft releases February 2025 Patch Tuesday cumulative update
• It fixes 55 security flaws, including four zero-days
• Of the four zero-days, two are being actively exploited

Microsoft has fixed a total of 55 Windows security vulnerabilities, including four zero-day bugs, including two that are being actively exploited in the wild.

Since some of the bugs addressed in the cumulative update are being actively exploited in the wild, users are advised to apply the fix immediately. The two flaws in question are CVE-2025-21391 (Windows Storage Elevation of Privilege vulnerability) and CVE_2025-21418 (Windows Ancillary Function Driver for WinSock Elevation of Privilege vulnerability).

Threat actors could use the first one to delete files from a target system, and the second one to gain SYSTEM privileges in Windows. Microsoft did not want to discuss who was abusing these flaws, how, or against whom.

Notable mentions

In total, Microsoft addressed 19 Elevation of Privilege bugs, 2 ...