Microsoft’s November 2025 Patch Tuesday fixes 63 security flaws across Windows, Office, .NET, and developer tools, five of them rated critical. The most urgent is an actively exploited Windows Kernel zero-day, CVE-2025-62215, which attackers are already using to gain full control of affected machines. The single most important action, for home users and businesses alike, is to install the update now.
What happened
On its November 2025 Patch Tuesday, Microsoft released fixes for 63 vulnerabilities across its software, including Windows, Office, .NET, and developer tools. Five are rated critical, and the rest important. The standout is a zero-day in the Windows Kernel, tracked as CVE-2025-62215, that Microsoft has confirmed was being exploited in the wild before the patch was available. It was discovered and reported by Microsoft’s own Threat Intelligence Center.
CVE-2025-62215 is an elevation-of-privilege flaw. On its own it does not break into a machine, but once an attacker already has a foothold, it lets them raise their access all the way to full SYSTEM control. That is why it is dangerous: it is the second step in a larger attack chain, often following something like a phishing email or a malicious download. The fact that it is already being used in real attacks is what makes patching urgent, regardless of its technical severity score.
The kinds of flaws fixed
The update addresses several familiar categories of vulnerability:
- Elevation of privilege. Lets an attacker raise a normal account to administrator or SYSTEM level. This month’s zero-day falls here.
- Remote code execution. Lets an attacker run their own code on a machine, potentially taking it over remotely.
- Information disclosure. Exposes data that should be private.
- Denial of service. Disrupts a system so it stops working normally.
Why it matters:
Your home PC is included. Update Windows today: open Settings, then Windows Update, and click Check for updates, then restart. Update Microsoft Office too. That is genuinely all most people need to do.
One unpatched machine can become an attacker’s stepping stone into the rest of the network. Prioritise the rollout, starting with internet-facing and high-value systems, and confirm the November update is actually reaching endpoints rather than assuming it is.
Prioritise CVE-2025-62215 (actively exploited, SYSTEM-level EoP via a kernel race condition) even though it is rated important rather than critical. Treat it as a live post-compromise escalation vector and pair patching with monitoring for anomalous privilege use. Also review the month’s critical RCEs for internet-exposed services.
What to do now
- Update Windows. Settings, then Windows Update, then Check for updates. Install everything offered and restart.
- Update Office. Open any Office app, then File, then Account, then Update Options, then Update Now.
- Turn on automatic updates so future fixes install themselves.
- Businesses: roll the update out on a priority schedule and verify coverage across your fleet.
Why regular patching matters
This update is a reminder of a wider habit. Attackers move fast once a flaw is known, and a zero-day like this one shows they sometimes move before a fix even exists. The two things that help most are speed and layers: apply security updates promptly, and do not rely on any single control. Patching closes known holes, while updated software, good passwords, and awareness of phishing work together to keep you protected. For many businesses, timely patching is also a compliance requirement, especially in regulated fields like finance and healthcare.
The wider point is simple. Even the most trusted, widely used software will have flaws that need attention. Making updates a routine part of how you run your devices, rather than something you postpone, is one of the most effective security habits there is.
Spotted an error? Report it to our editorial team.