• Microsoft released January 2025 Patch Tuesday cumulative update
• It fixes more than 150 vulnerabilities, including three being actively abused in the wild
• Other details about the flaws are not being disclosed at this time

The first Microsoft Patch Tuesday of 2025 is upon us, and it’s a big one, as the update patches 161 vulnerabilities found in various products, including three zero-day bugs that have been actively abused in the wild.

The three identified vulnerabilities are recorded as CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335. Each of these vulnerabilities carries a severity rating of 7.8 (high) and are associated with the Windows Hyper-V NT Kernel Integration VSP.

"An attacker who successfully exploited this vulnerability could gain SYSTEM privileges," Microsoft said in the advisory for the flaws.

Incorporated into CISA's Known Exploited Vulnerabilities (KEV) list.

Currently, no additional information is available, as Microsoft allows users ample time to implement the patch before any potential hackers can exploit the vulnerability. As a result, we remain unaware of the identity of the threat actors, the affected victims, or the methods employed by the attackers to breach their targets' IT systems.

However, in its write-up, The Hacker News says the trio are privilege escalation bugs, and, citing Satnam Narang, senior staff research engineer at Tenable, are thus “very likely used as part of post-compromise activity, where an attacker has already gained access to a target system by some other means."

Due to the active exploitation of these vulnerabilities, it is highly recommended that users implement the patch without delay. CISA has included all three vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, setting a deadline of February 4 for federal agencies to install the patch.

Although the three aforementioned vulnerabilities are considered the most perilous due to their active exploitation, Microsoft has also tackled 11 critical-severity issues. The other 149 vulnerabilities have been categorized as important. According to the Zero Day Initiative, this marks the most extensive Patch Tuesday since 2017. In addition to the regular updates, Microsoft released a separate patch for Edge browser vulnerabilities, rectifying seven security flaws.

You may also find interesting