Yesterday was Microsoft’s August 2025 Patch Tuesday, and it was a busy one: The company issued patches for 107 total vulnerabilities including one zero-day flaw for an exploit in Windows Kerberos.
Bleeping Computer reports that of the total flaws that were fixed, thirteen were rated critical. Of those thirteen critical flaws, nine were remote code execution style vulnerabilities, three were information disclosure attacks and one was an elevation of privilege.
The style of bugs from the total number of vulnerabilities breaks down to:
- 44 Elevation of Privilege vulnerabilities
- 35 Remote Code Execution vulnerabilities
- 18 information disclosure vulnerabilities
- 4 denial of service vulnerabilities
- 9 spoofing vulnerabilities
The zero-day vulnerability (tracked as CVE-2025-53779)is a Windows Kerberos Elevation of Privilege Vulnerability. It’s a flaw in Kerberos that would permit authenticated hackers to have domain administrator privileges over a network. However, according to Microsoft, the attacker would require elevated access to two dMSA attributes in order to exploit the vulnerability.
The two attributes are msds-groupMSAMembership, which would allow the user to utilize the dMSA and msds-ManagedAccountPreceededByLink, where the attacker needs write access to the attribute which allows them to specify a user that the dMSA can act on behalf of.
Microsoft has attributed the discovery of the flaw to Yuval Gordon of Akamai who published a technical report on the flaw in May.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
