Microsoft’s Patch Tuesday Patched 63 Vulnerabilities Out Of Which 3 Are Actively Exploited: CIA Releases Advisory

As usual, Microsoft delivered the Tuesday patch, fixing 63 security issues that affected its software products, including two vulnerabilities that it claimed were being actively exploited in the wild. Updates for actively exploited zero-day vulnerabilities have been made available by Microsoft. Federal agencies have three weeks, until March 4th, to put the mitigations into effect, according to CISA.

Three of the sixty-three vulnerabilities have been classified as Critical, fifty-seven as Important, one as Moderate, and two as Low in severity. Apart from this, Microsoft has fixed 23 bugs in its Edge browser, which is based on Chromium, since last month’s Patch Tuesday update.

Let’s Talk About The Flaws

• CVE-2025-21418 (CVSS score: 7.8) – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
• CVE-2025-21391 (CVSS score: 7.1) – Windows Storage Elevation of Privilege Vulnerability

“An attacker would only be able to delete targeted files on a system,” Microsoft said in an alert for CVE-2025-21391. “This vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable.”

This vulnerability, known as CVE-2025-21391, gives attackers the ability to increase privileges, remove data, and stop services from working. The severity is 7.1 out of 10.

“This vulnerability could allow an attacker to delete data, including data that results in the service being unavailable,”

CISA added in its advisory.

The Windows Ancillary Function Driver for WinSock is the source of a heap-based buffer overflow vulnerability. Advanced Windows networking functions are managed by this central component. Successful exploiters of this vulnerability, known as CVE-2025-21418, are granted SYSTEM privileges. There are currently no alternative mitigations or solutions available, and the exploit code is functional. Microsoft assigned a 7.8 out of 10 severity rating to this defect.

Whether the Lazarus Group is also connected to the misuse of CVE-2025-21418 is unknown at this time. Both vulnerabilities have been added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalogue, and federal agencies must implement the fixes by March 4, 2025.

These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Said CISA In There Advisory

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability : CVE-2025-21198

CVE-2025-2119, a remote code execution (RCE) vulnerability in the High Performance Compute (HPC) Pack, is the most serious of the vulnerabilities Microsoft fixed in this month’s update. By submitting a specifically constructed HTTPS request to the Linux compute node or the targeted head node, an attacker might take advantage of this vulnerability and perform RCE on other clusters or nodes that are connected to the targeted head node.