June Patch Tuesday brings a lighter load for defenders

Microsoft’s latest Patch Tuesday update landed on schedule around teatime on 10 June, with admins facing a much lighter load heading into the summer – at least lighter than of late – with barely 70 security flaws awaiting attention and just two potential zero-day common vulnerabilities and exposures (CVEs) in scope.

The two most pressing issues for patching this month are CVE-2025-33053, a remote code execution (RCE) flaw in Web Distributed Authoring and Versioning (WEBDAV), and CVE-2025-33073, an elevation of privilege (EoP) vulnerability in Windows Server Message Block (SMB) Client. Both carry a CVSS score of 8.8.

Microsoft revealed it has evidence that the first of these CVEs is already being exploited in the wild, although proof-of-concept code is not publicly available, while for the second, the opposite is true. It credited the RCE flaw to Alexandra Gofman and David Driker of Check Point Research, and the second to researchers with CrowdStrike, Synacktiv, SySS GmbH, and Google Project Zero.

Of these two, CVE-2025-33053 probably presents the most pressing patching need. This is because in practice, the issue affects various tools that still incorporate the defunct Internet Explorer browser in a legacy capacity, hence Microsoft has been forced into the position of producing patches for long out-of-support platforms, dating back as far as Windows 8 and Server 2012.

“This vulnerability allows attackers to execute remote code on affected systems when users click on malicious URLs,” explained Mike Walters, president and co-founder of patch management specialist Action1.

“The exploit takes advantage of WebDAV’s file handling capabilities to run arbitrary code in the context of the current user. If the user holds administrative privileges, the impact can be severe.  

“What makes this flaw particularly concerning is the widespread use of WebDAV in enterprise environments for remote file sharing and collaboration. Many organisations enable WebDAV for legitimate business needs – often without fully understanding the security risks it introduces,” said Walters.

“The potential impact is extensive, with millions of organisations worldwide at risk. An estimated 70 to 80% of enterprises could be vulnerable – especially those lacking strict URL filtering or user training on phishing threats,” he added.

Meanwhile, Ben Hopkins, cyber threat intelligence researcher at Immersive, ran the rule over the second potential zero-day, CVE-2023-33073.

“It’s classified as an Elevation of Privilege vulnerability, which indicates that a successful exploit would allow an attacker to gain higher-level permissions on a compromised system,” explained Hopkins.

“Threat actors highly seek out vulnerabilities of this nature. Once an attacker has gained an initial foothold on a machine, often through methods like phishing or exploiting another vulnerability, they can leverage privilege escalation flaws to gain deeper control.”

He continued: “With elevated privileges, an attacker could potentially disable security tools, access and exfiltrate sensitive data, install persistent malware, or move laterally across the network to compromise additional systems.

“Given the high severity rating and the critical role of SMB in Windows networking, organisations should prioritise applying the necessary security patches to mitigate the risk posed by this vulnerability.”