- Microsoft fixes 161 vulnerabilities in its first Patch Tuesday of 2025, including three actively exploited zero-days.
- Critical failures are related to the system Windows Hyper-V and may allow privilege escalation.
- CISA urges patching by February 4 to mitigate further risks.
- Additionally, vulnerabilities in products such as Microsoft Edge, making this launch the largest since 2017.
With the start of 2025, Microsoft released its first Patch Tuesday of the annual update cycle. This event, already known for being key to managing cybersecurity, has once again demonstrated the importance of staying up-to-date with the latest fixes. Microsoft addressed a total of 161 vulnerabilities present in multiple products, some of them classified as critical due to their potential impact.
This release is notable for including fixes for three zero-day vulnerabilities that were already being actively exploited . These flaws, listed as CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335, received a severity score of 7.8 on the CVSS scale, placing them among the most critical in this series of updates. According to Microsoft, these vulnerabilities affect the NT integration core of the Windows Hyper-V system, which could allow an attacker to escalate privileges and gain full access to affected systems.
The severity of zero-day vulnerabilities
Zero-day vulnerabilities pose a constant threat in the world of cybersecurity , especially when they have already begun to be actively exploited . In this case, Microsoft has not provided specific details about the attackers responsible or the affected victims, although it emphasized that these flaws are primarily used in the privilege escalation phase of a larger attack. This indicates that, in many cases, the target systems would have already been compromised through other methods.
The Cybersecurity and Infrastructure Security Agency (CISA) has also taken action , adding these vulnerabilities to its catalog of Known Exploited Vulnerabilities (KEVs). This move aims to alert both government agencies and end users to the urgent need to implement these updates. The deadline set by CISA for federal organizations to deploy the patches is February 4th.
An unprecedented launch since 2017
In addition to the three zero-day vulnerabilities, Microsoft has also patched 11 other flaws classified as critical . These include issues related to remote code execution and unauthorized access that could have been used to compromise sensitive data or disrupt critical operations in enterprise systems.
The remaining 149 vulnerabilities were classified as critical . While not as severe as the previously identified ones, these flaws still pose a considerable risk if not properly addressed. According to the Zero Day Initiative, a recognized player in the cybersecurity field, this first Patch Tuesday of 2025 marks Microsoft's largest update event since 2017.
On the other hand, in a separate update, seven vulnerabilities in the Microsoft Edge browser were also fixed . These flaws, while minor in comparison, should not be underestimated, as they affect millions of users who use this browser daily.
The importance of implementing updates
Organizations and individual users are being urged to act quickly to ensure their systems remain protected against potential threats. Updates are now available for download through Microsoft's usual channels, including Windows Update and centralized management systems.
In a rapidly evolving technological environment, software vulnerabilities have become a common target for cybercriminals. Therefore, security patches like those distributed this Patch Tuesday play a fundamental role in preserving system integrity, preventing operational disruptions, data loss, and reputational damage.
This first Patch Tuesday of 2025 not only marks a milestone in terms of the number of fixes , but also underscores Microsoft's commitment to staying at the forefront of the fight against cyber threats.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.