February 2025 Patch Tuesday: Microsoft Fixes Two Exploited Zero-Days and 55 Security Flaws

Microsoft’s February 2025 Patch Tuesday delivered fixes for 55 vulnerabilities, including four zero-days. Among these, two flaws—already exploited in active attacks—target Windows Core Messaging and NTFS, highlighting the growing urgency for organizations to keep their systems updated.

These updates also address vulnerabilities in Azure and other widely used Microsoft services, underscoring the company’s ongoing battle against escalating cyber threats. The full details of the vulnerabilities are available in Microsoft’s Security Update Guide.

The February patch cycle demonstrates the increasing speed at which attackers exploit unpatched systems. “Customers are strongly encouraged to install these updates immediately,” Microsoft stated in its advisory.

This proactive stance is crucial as organizations face challenges in securing hybrid environments and critical infrastructure against a rapidly evolving threat landscape.

Zero-Days Exploited Before the Patch Release

Two of the four zero-days patched this month were actively exploited in the wild. The first, CVE-2025-21184, involves Windows Core Messaging, a key subsystem responsible for facilitating communication between applications and the operating system.

Exploiting this flaw allows attackers to escalate privileges, giving them unauthorized access to sensitive resources within the system. The vulnerability has already been leveraged in targeted attacks, according to Microsoft’s advisory.

The second exploited zero-day, CVE-2025-21337, affects NTFS, the file system used in all modern versions of Windows. By exploiting this vulnerability, attackers can elevate privileges and potentially access critical system data.

NTFS is a core component of Windows, responsible for managing file storage and retrieval, making this flaw especially concerning for enterprise users.

These vulnerabilities were actively exploited before the patches were available, raising the stakes for organizations with unpatched systems. To mitigate risks, Microsoft has issued detailed guidance in its advisory, urging administrators to prioritize these updates. These patches continue the focus on resolving zero-day vulnerabilities, a recurring theme in recent Patch Tuesday updates.

Cloud and Enterprise Vulnerabilities in Focus

Azure Network Watcher, Microsoft’s cloud monitoring and diagnostic tool, was also patched in this release. The vulnerability, CVE-2025-21188, allowed privilege escalation within hybrid cloud environments.

Although no active exploitation was reported, the potential impact of such a flaw in cloud infrastructure highlights the importance of securing hybrid setups. Businesses relying on Microsoft’s cloud offerings should ensure these updates are implemented without delay.

Another vulnerability patched this month, CVE-2025-21198, targeted the High-Performance Compute (HPC) Pack for Linux nodes, commonly used in hybrid cloud systems.

This elevation-of-privilege flaw underscores the risks associated with managing multi-cloud environments, particularly as businesses continue to integrate diverse platforms into their IT strategies.

Microsoft Office and Edge: Widespread Tools, Critical Risks

Beyond zero-days and cloud vulnerabilities, the February update addressed security flaws in widely used Microsoft applications. Among the most notable is CVE-2025-21381, a remote code execution (RCE) vulnerability in Microsoft Excel.

Attackers exploiting this flaw can use malicious spreadsheet files to execute unauthorized commands on a victim’s system. Given Excel’s ubiquity in enterprise environments, this vulnerability posed a significant risk to business operations and sensitive data.

Microsoft Edge, the company’s Chromium-based browser, was also included in the patch cycle. The updates fixed several security issues, including RCE vulnerabilities and spoofing flaws that could allow attackers to bypass security features or execute malicious code via compromised websites. These fixes are part of Microsoft’s ongoing efforts to enhance browser security, particularly as Edge plays an increasingly central role in enterprise IT ecosystems.

Strengthening Core Windows Components

Microsoft also addressed vulnerabilities in foundational components of the Windows operating system. The Resilient File System (ReFS), often used for data deduplication and advanced storage scenarios, received a critical patch to prevent unauthorized access.

Similarly, flaws in Windows DHCP Server and Internet Connection Sharing (ICS) services were fixed, reducing the risk of denial-of-service (DoS) attacks and other network disruptions.

In addition, vulnerabilities in Core Messaging and the Windows Kernel, including CVE-2025-21359 and CVE-2025-21358, were resolved. While these issues have not yet been exploited, they could allow attackers to bypass security protections if left unaddressed. 

The scope of this month’s updates underscores a growing challenge for enterprises: securing interconnected systems that span on-premises, cloud, and hybrid environments. As attackers increasingly target multi-platform ecosystems, Microsoft’s patches address risks across its product lineup, from widely used tools like Excel to enterprise infrastructure components like HPC Pack.

Real-world examples highlight the risks of delayed patching. In recent months, attackers have exploited similar vulnerabilities to deliver ransomware, compromise sensitive data, and disrupt critical services.

Complete List of Microsoft February 2025 Security Updates