Microsoft Zero-Day Vulnerability Under Attack by 11 Global Cyber Groups

AIThis post was created with the assistance of artificial intelligence (AI).

As cyber threats continue to evolve, Microsoft is grappling with six zero-day vulnerabilities that are currently under active attack. You should be aware that these vulnerabilities primarily affect core components of Windows and popular Microsoft products like Office. The nature of these vulnerabilities varies, including remote code execution, elevation of privilege, and information disclosure. With CVSS scores ranging from 4.6 to 7.8, the severity is high, indicating that your systems could be at significant risk. More than 75% of the vulnerabilities are classified as high-severity, highlighting the critical need for immediate attention.

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

Fast, free delivery on millions of items
Prime Video, Amazon Music and more included
Member-only deals all year

Start your free Prime trial Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.

Advanced persistent threat groups and cybercriminal organizations are exploiting these vulnerabilities for various malicious purposes. For instance, attackers might use malicious VHD files or even physical access—such as inserting a compromised USB drive—to execute their plans. Once inside, these vulnerabilities can allow attackers to gain kernel-level access, bypassing application-level security and potentially leading to information disclosure.

Cybercriminals exploit these vulnerabilities using malicious files or physical access, enabling kernel-level access and potential information disclosure.

Imagine an attacker being able to read heap memory or elevate their privileges on your compromised system; the implications are severe.

Among the specific vulnerabilities, CVE-2025-24983 stands out as a use-after-free vulnerability in the Windows Win32 Kernel Subsystem, while CVE-2025-24984 allows for NTFS information disclosure, but it requires physical access to exploit. Other vulnerabilities include CVE-2025-24985, an integer overflow in the Windows Fast FAT File System Driver, and CVE-2025-24991, which enables out-of-bounds read vulnerabilities in NTFS. These specific weaknesses are a goldmine for cybercriminals.

You should also consider the threat actors involved. Eleven nation-state actors have been exploiting an unpatched Windows zero-day vulnerability for years, along with financially motivated groups seeking monetary gain. These attackers target various sectors, including government agencies and financial organizations, often employing tactics like malicious shortcut files to execute hidden commands without detection.

To protect against these vulnerabilities, Microsoft regularly releases patches, and the U.S. Cybersecurity and Infrastructure Security Agency mandates that federal agencies apply them promptly. It’s essential for you to implement robust patch management strategies and consider network segmentation to reduce your attack surface.

Developing comprehensive incident response plans will also prepare you for any potential security incidents. In today’s evolving landscape of cyber threats, staying informed and proactive is your best defense against the exploitation of these zero-day vulnerabilities.