May 2025 Patch Tuesday: Five Zero-Days, 78 Fixes and a CVSS-10 Azure DevOps Bug
Microsoft’s May Patch Tuesday (released 13 May 2025, landing on most EU desktops in the early hours of 14 May) is one of the most event-packed security drops this year. The update batch tackles 78 security flaws (11 Critical, 66 Important, 1 Low) and includes five zero-days already exploited in the wild. Adobe, for its part, published 13 advisories covering 40 CVEs across its creative-suite portfolio. Below is BaseFortify’s quick-reaction analysis and patch-prioritisation guidance.
The five exploited Windows zero-days you must fix first
| CVE | Component | Impact | Why it matters |
|---|---|---|---|
| CVE-2025-30397 | Windows Scripting Engine | Remote Code Execution | Drives Edge into IE-mode, letting a malicious link execute attacker code (open-and-own). |
| CVE-2025-30400 | Desktop Window Manager (DWM) | Privilege Escalation → SYSTEM | Third in-the-wild DWM EoP since 2023; frequently paired with phishing payloads. |
| CVE-2025-32701 CVE-2025-32706 |
Common Log File System (CLFS) | Privilege Escalation → SYSTEM | Seventh & eighth CLFS zero-days since 2022; ransomware crews favour this vector. |
| CVE-2025-32709 | Ancillary Function Driver for WinSock | Privilege Escalation → SYSTEM | Third WinSock EoP in a year; previously abused by Lazarus operators. |
All five are now on CISA’s Known Exploited Vulnerabilities list with a 3 June federal deadline — treat them as emergency fixes in EU production environments as well.
Other Microsoft highlights
- Azure DevOps Server EoP (CVE-2025-29813, CVSS 10.0) — already mitigated in the cloud, but on-prem customers must patch before exposing build pipelines.
- Office preview-pane RCEs (CVE-2025-30377 & -30386) — no user click required; simply receiving a crafted file can trigger code execution.
- Two Remote Desktop Client RCEs (CVE-2025-29966 / -29967) — exploitable when users connect to a malicious RDP server.
- URLMon security-feature bypass (CVE-2025-29842) — lets attackers drop Office docs straight into edit mode, undermining Protected View.
Altogether, Microsoft logged 28 RCEs, 21 privilege-escalation bugs and 16 info-disclosures this month, pushing its year-to-date CVE count ahead of the 2024 pace.
Adobe’s “unlucky 13” bulletins
Adobe shipped 40 CVEs across 13 products. No active exploitation is reported, but ColdFusion should be your top priority (seven Criticals plus a likely patch bypass). Photoshop, Animate, Bridge and the Substance 3D suite also pick up Critical RCE fixes triggered by opening crafted files.
Recommended patching sequence for EU enterprises
- Deploy Windows cumulative updates immediately on all endpoints and servers to neutralise the five zero-days.
- Fast-track Azure DevOps Server (on-prem) and Office preview-pane fixes; both enable widescale compromise.
- Update internet-facing services: RDP Gateway, RD Client, SharePoint, Remote Desktop Services.
- Roll out Adobe ColdFusion, then creative-suite patches to all design/marketing workstations.
- Harden legacy configurations — disable IE-mode where possible; restrict WinSock driver loading to signed binaries; monitor CLFS activity for suspicious deletions.
Final thoughts
May’s Patch Tuesday reinforces a clear trend: attackers combine low-complexity local privilege escalations with browser- or document-based code execution to gain full control fast. With four of the five zero-days delivering instant SYSTEM rights, speed of deployment matters more than CVSS numbers this month.
BaseFortify is Europe’s community platform for vulnerability intelligence, automated patch validation and threat-informed hardening guidance. Our dashboards track vendor advisories, map them to your technology stack and simulate exploit paths before attackers do. You can register for free and start monitoring your environment in minutes at https://basefortify.eu/register.
