News BriefCRITICALIntermediate4 min read

January 2025 Patch Tuesday: 8 Zero-Days, 3 Critical — What to Prioritize

Microsoft's January 2025 Patch Tuesday addressed 159 vulnerabilities including 8 zero-days (3 exploited in the wild) and critical RCE flaws in Windows OLE, LDAP, and Hyper-V.

January 14, 2025Verified

Microsoft Security Update Guide Dustin Childs / ZDI

Overview

Microsoft's January 2025 Patch Tuesday is the largest patch release in recent memory, covering 159 CVEs across Windows, Office, Azure, and developer tools.

Critical Priorities

CVE-2025-21298 — Windows OLE RCE (CVSS 9.8)

Email preview in Outlook triggers RCE without user interaction. Apply immediately. Interim: set Outlook to read email in plain text.

CVE-2025-21333 — Hyper-V PrivEsc (Zero-Day, Exploited)

Local attacker achieves SYSTEM on Windows 11 and Server 2025. Confirmed exploited in the wild.

CVE-2025-21311 — Windows NTLM V1 Elevation (CVSS 9.8)

Critical elevation via NTLM V1 — disable NTLMv1 in environment before patching for defense-in-depth.

Patch Priority Order

Windows domain controllers (LDAP, Kerberos bugs)
Exchange and Outlook servers (OLE RCE)
Hyper-V hosts
All endpoints (3 exploited zero-days)
Azure-connected services

Testing Notes

KB5050009 has known printing issues on some HP LaserJet models — test before broad deployment
Server 2025 LSASS restart required for Kerberos patch KB5049613

Microsoft Windows Patch Management LDAP

NEWSCVE-2024-55591

#StopRansomware: Gunra Ransomware

Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastru...

WHY IT MATTERS

Official CISA advisory — read the full bulletin for impact and mitigation guidance before acting.

MicrosoftFortinetGoogle+2 more

1d ago· 28 min read

NEWSHIGHCVE-2025-14847

ABB Ability Zenon

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected: IIo...

WHY IT MATTERS

Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data.

WindowsDenial of ServiceHealthcare

5d ago· 22 min read

TOOL

Shadow AI Audit: Find Which AI Apps Can Read Your Company Data in Entra ID

A free, read-only PowerShell audit that lists every AI application holding OAuth consent in your Microsoft Entra ID tenant — who approved it, what it can read, and whether it holds a refresh token that survives a password change.

WHY IT MATTERS

One employee clicking Accept on an AI app can grant it standing access to everything that user can reach. Tenant-wide admin consent extends that to everyone. Neither shows up in a vulnerability scan, and neither is revoked by a password reset.

Shadow AIEntra IDOAuth+2 more

12d ago· 5 min read

Overview

Critical Priorities

CVE-2025-21298 — Windows OLE RCE (CVSS 9.8)

CVE-2025-21333 — Hyper-V PrivEsc (Zero-Day, Exploited)

CVE-2025-21311 — Windows NTLM V1 Elevation (CVSS 9.8)

Patch Priority Order

Testing Notes

Related

#StopRansomware: Gunra Ransomware

ABB Ability Zenon

Shadow AI Audit: Find Which AI Apps Can Read Your Company Data in Entra ID