Microsoft’s April 2025 Patch Tuesday: 121 Vulnerabilities Patched, Including One Zero-Day Exploited in the Wild

Microsoft’s April 2025 Patch Tuesday has landed — and it’s another big one. This month’s update addresses 121 vulnerabilities (CVEs) across a wide range of Microsoft products and services. Among them is a zero-day vulnerability that has already been exploited in the wild, highlighting the ongoing urgency for staying on top of security updates.

Here’s what IT admins, security professionals, and everyday users need to know.

By the Numbers

• 121 total vulnerabilities fixed
• 11 rated Critical
• 110 rated Important
• 0 Moderate or Low severity

This month’s breakdown shows a significant number of elevation of privilege (EoP) vulnerabilities, making up 40.5% of the total. Remote code execution (RCE) flaws come next at 25.6%, followed by information disclosure, denial of service, and spoofing vulnerabilities.

These types of vulnerabilities are especially valuable to attackers seeking to move laterally within environments or escalate their access after an initial compromise.

Zero-Day Vulnerability: Exploited in the Wild

CVE-2025-29824 is the standout zero-day of the month. This is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) Driver, rated Important with a CVSSv3 score of 7.8. What makes it more alarming is its confirmed exploitation in the wild, linked to ransomware deployments by the group Storm-2460, via the PipeMagic malware.

The CLFS driver has a history of being a popular target for attackers. Microsoft patched eight CLFS vulnerabilities in 2024, including another exploited zero-day (CVE-2024-49138), and has addressed similar issues annually since 2022. Organizations should prioritize patching this one without delay.

Critical Remote Code Execution (RCE) Vulnerabilities

Several vulnerabilities this month were rated Critical due to their potential for remote code execution:

• CVE-2025-26671, CVE-2025-27480, CVE-2025-27482 – These affect Windows Remote Desktop Gateway Services. Attackers could exploit a race condition to execute code remotely. Two are rated Critical and flagged as “Exploitation More Likely” by Microsoft.
• CVE-2025-26663, CVE-2025-26670 – These impact Windows LDAP and LDAP Client, and are also rated Critical. Exploiting these requires a carefully crafted request that leads to a use-after-free condition. If successful, attackers could execute arbitrary code on a vulnerable system.

Microsoft also patched other LDAP-related vulnerabilities, including two denial-of-service issues (CVE-2025-26673 and CVE-2025-27469), which are less severe but still worth monitoring.

Other High-Impact Vulnerabilities

• CVE-2025-27740 – A vulnerability in Active Directory Certificate Services that could allow an attacker to elevate privileges and gain domain admin access by manipulating computer accounts. Rated Important with a high CVSS score of 8.8, this is a serious concern for enterprise environments.
• CVE-2025-29793 & CVE-2025-29794 – Affecting Microsoft SharePoint Server, these RCE vulnerabilities require authentication to exploit but could allow attackers to execute arbitrary code. Given SharePoint’s widespread use in corporate settings, these should not be overlooked.

Affected Products

This month’s patches span a wide range of Microsoft software and services, including but not limited to:

• Windows (Core, Kernel, Drivers, BitLocker, Hyper-V, etc.)
• Microsoft Office (Excel, Word, SharePoint, OneNote)
• Active Directory & Certificate Services
• Azure, ASP.NET Core
• Visual Studio & Visual Studio Code
• Remote Desktop Services
• OpenSSH for Windows
• Windows Subsystem for Linux
• Outlook for Android
• Microsoft AutoUpdate (MAU)

In short, whether you’re using Microsoft on the desktop, in the cloud, or in enterprise infrastructure, there’s likely a fix this month relevant to you.

Conclusion & Recommendations

Microsoft’s April 2025 Patch Tuesday is a reminder of just how broad the modern attack surface has become — from local privilege escalations to remote code execution via network services. The presence of an exploited zero-day, combined with several “Exploitation More Likely” vulnerabilities, makes this a high-priority update cycle.

Our recommendations:

1. Prioritize the zero-day (CVE-2025-29824) and the Critical RCEs affecting RDP and LDAP.
2. Patch all systems as soon as possible, especially those running SharePoint, Active Directory, and Remote Desktop services.
3. Scan your environment using up-to-date vulnerability assessment tools to ensure full coverage.
4. Monitor threat intelligence sources for signs of active exploitation or proof-of-concept exploits that may emerge in the coming weeks.
5. Test patches in staging environments when feasible, especially for critical infrastructure, before deploying them in production.

To view the full list of patched vulnerabilities and get additional technical details, visit the official Microsoft Security Update Guide for April 2025:
👉 https://msrc.microsoft.com/update-guide/en-us/releaseNote/2025-apr

Stay safe, stay patched, and don’t give attackers an easy entry point.