Critical Microsoft Vulnerabilities More Than Doubled in 2025, BeyondTrust Report Says
Summary
BeyondTrust’s summary of the 2026 Microsoft Vulnerabilities Report says critical Microsoft vulnerabilities rose from 78 to 157 in 2025, with sharp increases in Office and Azure/Dynamics 365, and urges stronger privilege and identity controls.
Key points
- The article says Microsoft disclosed 1,273 vulnerabilities in 2025, down from 1,360 in 2024, while critical vulnerabilities increased from 78 to 157.
- Elevation of Privilege vulnerabilities accounted for 40% of the total; Information Disclosure flaws rose 73%, according to the report.
- Critical vulnerabilities in Azure and Dynamics 365 rose from 4 to 37; the article cites CVE-2025-55241 as an Entra ID flaw patched in July 2025 that could allow forged tokens accepted across tenants.
- Microsoft Office vulnerabilities increased 234%, from 47 to 157, while critical Office vulnerabilities rose from 3 to 31.
- The article recommends auditing standing administrator rights, scrutinizing service accounts and AI agents, and disabling the Windows preview pane, which it says was an entry point exploited by seven CVEs in 2025.
- It argues patch management alone is insufficient and emphasizes reducing excessive privilege, improving identity visibility, and prioritizing vulnerabilities that enable privilege escalation and lateral movement.
Article Details
- Publisher
- BleepingComputer; sponsored and written by BeyondTrust
- Report Period
- Microsoft vulnerabilities disclosed in 2025; report published May 19, 2026
- Scope
- Analysis of Microsoft vulnerability trends and their potential security impact
- Sample Size
- 1,273 Microsoft vulnerabilities disclosed in 2025
- Key Statistics
- Microsoft disclosed 1,273 vulnerabilities in 2025, down from 1,360 in 2024.
- Critical vulnerabilities increased from 78 in 2024 to 157 in 2025.
- Elevation of Privilege vulnerabilities accounted for 40% of all CVEs; Information Disclosure flaws rose 73%.
- Critical vulnerabilities in Microsoft Azure and Dynamics 365 rose from 4 to 37 in one year.
- Microsoft Office vulnerabilities rose 234% year over year, from 47 to 157; its critical vulnerabilities rose from 3 to 31.
- Recommendations
- Audit standing administrator rights and reduce excessive privilege.
- Apply scrutiny to service accounts and AI agents comparable to that applied to human identities.
- Disable the Windows preview pane.
- Prioritize vulnerabilities that enable privilege escalation, identity abuse, and lateral movement rather than relying on patch management alone.
- Improve identity visibility and conduct continuous risk assessment.
MITRE ATT&CK
CVE
Vendors
Products
Entra IDCVE-2025-55241, a critical Entra ID flaw patched in July 2025, illustrated this precisely: an attacker could forge tokens accepted across any tenant, leaving no trace in victim logs.Microsoft AzureMicrosoft Azure and Dynamics 365 decreased slightly in total vulnerability count, but critical vulnerabilities spiked dramatically, jumping from 4 to 37 in a single year.Microsoft Dynamics 365Microsoft Azure and Dynamics 365 decreased slightly in total vulnerability count, but critical vulnerabilities spiked dramatically, jumping from 4 to 37 in a single year.Microsoft OfficeMicrosoft Office vulnerabilities surged 234% year over year, rising from 47 to 157, with critical vulnerabilities jumping from 3 to 31 (a 10x increase from last year).Microsoft WindowsTotal Microsoft Windows vulnerability numbers declined, yet critical counts remained stubbornly consistent and unnervingly high.Microsoft Windows ServerMicrosoft Windows Server vulnerabilities increased to 780, with 50 classified as critical.