Microsoft ends 2025 with Major Patch Tuesday cleanup
Microsoft wrapped up the year with its final patch Tuesday, rolling out security fixes for 56 newly discovered vulnerabilities. With this batch, the total number of issues patched in 2025 climbs to an impressive 1,139. The updates don’t just touch Windows and Office, but also reach across Azure, Copilot, Defender, Exchange, and PowerShell.
The next major patch wave is expected on January 13, 2026, but for now, here’s what stood out.
Most of this month’s fixes, to be precise, 38 of them, land in the Windows ecosystem. Even though Windows 10 stopped receiving regular support in October, it still appears in the list of affected platforms, something that didn’t happen with Windows 7 during its ESU phase.
The most urgent issue this month is CVE-2025-62221, an Elevation of Privilege flaw in the cloud file mini-filter driver. Attackers are already using it, and when paired with a Remote Code Execution bug, it can grant system-level access. Two additional, similar vulnerabilities were closed as well, though those aren’t currently under active attack.
There are no Windows “critical” vulnerabilities this time, but several are still worth noting, including EoP and DoS flaws in the DirectX graphics stack. PowerShell received a fix for a previously public RCE vulnerability, and RRAS once again appears with three new issues, one of them an RCE.
Office saw another heavy month with 15 patched vulnerabilities, 14 of which allow remote code execution. Two are marked critical because attacks can trigger through the preview pane alone. Excel, Word, Outlook, and Access all receive fixes. Exchange Server also got two patches, including an NSA-reported EoP flaw, even though organizations running Exchange 2016 or 2019 will need the ESU program to stay protected until April 2026.
