Microsoft, Apple fix exploited flaws on Patch Tuesday

Patch Tuesday It's that time of the month again, and Microsoft has made it extra spicy by revealing five flaws it says are under active exploitation – but rates as important rather than critical fixes. Microsoft's 78-fix bundle for this Patch Tuesday wasn't unusually large, but the five problems under attack right now all have CVSS severity scores of 7.5 or 7.8 out of 10, and hit Windows 10 and 11 devices, and Windows Server releases since 2019. They look like strong candidates to be top of your patching list in your next change window. The five exploited flaws are: After you deal with the above, the next three Microsoft patches of interest are Azure problems – especially the 10/10 rated CVE-2025-29813, an authentication bypass attack on the cloud platform's DevOps platform. CVE-2025-29827 allows elevation of privilege attacks against Azure Automation, and CVE-2025-29972 is a spoofing attack against Azure Storage. Crucially, Microsoft has already fixed all three in production, and says it added the CVE information to the patch bundle to "provide further transparency." You can see the rest of the critical fixes and patches-of-interest in May's batch below, a summary courtesy of Trend Micro's Zero Day Initiative. "There are seven lucky Denial-of-Service (DoS) bugs getting patches this month," commented Dustin Childs, head of threat awareness at Trend's ZDI. However, Microsoft provides no actionable information about these bugs. Instead, they simply state that an attacker could ...