Patch Tuesday, June 2025
Microsoft's monthly security release, Tuesday, June 10, 2025. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 8.8HighJun 10, 2025Microsoft Windows Path traversal / file handlingCVE-2025-33053Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.Exploited87% likelyExploit codeMetasploitDetection
- 8.8HighJun 10, 2025Microsoft Windows Auth bypass / access controlCVE-2025-33073Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.Exploited83% likelyExploit codeExploit-DB
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.