August Patch Tuesday: Microsoft Tackles 111 Vulnerabilities to Enhance Security.
On 12 August, Microsoft acknowledged public disclosure of a single vulnerability, claiming no evidence of in-the-wild exploitation. This marks the continuation of a fortunate streak for Microsoft, as the lone Patch Tuesday zero-day vulnerability is assessed as only moderate severity, extending their luck to 11 months. The release includes nine critical Remote Code Execution (RCE) vulnerabilities, with only one identified as more likely to be exploited. Additionally, eight browser vulnerabilities were published separately earlier this month and are not included in the total count.
The lone zero-day vulnerability, CVE-2025-53779, represents an elevation of privilege (EoP) vulnerability within the Windows implementation of Kerberos. This vulnerability can be exploited through the abuse of Delegated Managed Service Account (dMSA) configuration. While the advisory FAQ offers more insights into the nature of the attack compared to other Microsoft advisories, it fails to clarify the term dMSA, leaving readers to search for contextual clues. Ultimately, this vulnerability could provide attackers with the means to breach final layers of protection and gain access to critical system resources.
Categories: Vulnerabilities, Exploitation, Security Updates
Tags: Vulnerabilities, Disclosure, Exploitation, Severity, Execution, Browser, Attackers, Privilege, Configuration, Context