Microsoft's February Patch a Lighter Lift Than January's

Microsoft's February 2025 security update addresses 63 CVEs, including multiple critical remote code execution and privilege-escalation flaws and several zero-day vulnerabilities. The bulletin calls out two zero-days being actively exploited (CVE-2025-21418 and CVE-2025-21391), previously disclosed unpatched issues (e.g., CVE-2025-21377), and other high-severity bugs affecting Windows components, Microsoft Dynamics 365, Excel, LDAP, and HPC — urging administrators to prioritize immediate patching to prevent SYSTEM-level escalation, data deletion, and lateral movement.