Microsoft reports 7.8-rated zero day, plus 56 more in December Patch Tuesday

December Patch Tuesday coverage: Microsoft fixed a zero-day Windows Cloud Files mini-filter privilege escalation (CVE-2025-62221) plus two publicly known RCE issues; Notepad++ released v8.8.9 to mitigate an update-hijack used in active attacks reportedly linked to Chinese actors; Fortinet patched critical SAML bypass flaws (CVE-2025-59718/59719) affecting multiple products; and Ivanti patched a critical unauthenticated stored XSS in EPM (CVE-2025-10573) that can grant admin session control — administrators are advised to prioritize patching and to disable affected features (e.g., FortiCloud SSO) until updates are applied.