Microsoft Vulnerabilities Drop, But Critical Flaws Double, Report Warns

BeyondTrust’s 13th annual Microsoft Vulnerabilities Report shows overall Microsoft bug counts fell slightly but critical vulnerabilities have doubled, with alarming spikes in Microsoft Office, Windows Server, Azure and Dynamics 365; the report cites a high-impact CVE (CVE-2025-55241) enabling Global Administrator impersonation, three zero-days observed in the wild, and widespread elevation-of-privilege and non-human identity risks, urging least-privilege controls, harder guardrails, and adversarial testing.