BeyondTrust Report: Critical Microsoft Vulnerabilities Doubled in 2025
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
BeyondTrust's 2026 report counts 1,273 Microsoft vulnerabilities in 2025, down 6%, but Microsoft-rated critical flaws doubled to 157. Office and cloud products drove the increase, while privilege escalation remained the largest category.
Key points
- The report compiles Microsoft's 2025 vulnerability disclosures, using the highest severity for each vulnerability; product-level counts can overlap.
- Microsoft-rated critical vulnerabilities rose from 78 to 157 despite a decline in total disclosures. CVSS-based scoring classified 42 as critical, highlighting the difference between rating systems.
- Elevation of Privilege accounted for 509 vulnerabilities, or 40% of the total; information disclosure flaws increased from 101 to 175.
- Office vulnerabilities increased from 47 to 157, including 31 critical flaws versus three in 2024. Azure and Dynamics 365 critical flaws rose from four to 37.
- Windows Server vulnerabilities increased from 684 to 780, including 50 critical flaws. Edge disclosures fell 83% to 50, with none rated critical.
- The report warns that CVE counts do not capture all cloud, AI and identity risks, including excessive permissions and poorly governed non-human identities.
- BeyondTrust recommends environment-specific patch prioritization alongside least privilege, reduced standing access, identity monitoring and governance of secrets and tokens.
Article Details
- Publisher
- BeyondTrust
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Analysis of Microsoft's published vulnerability disclosures, severity ratings, product lines, and vulnerability categories. Product-level counts can overlap; product versions and combinations were not considered.
- Sample Size
- 1,273 Microsoft vulnerabilities reported for 2025.
- Key Statistics
- Total Microsoft vulnerabilities decreased approximately 6%, from 1,360 in 2024 to 1,273 in 2025.
- Critical vulnerabilities under Microsoft's Security Update Severity Rating System increased from 78 in 2024 to 157 in 2025; CVSS-based classification identified 42 critical vulnerabilities in 2025.
- Elevation of Privilege accounted for 509 vulnerabilities, or 40% of the 2025 total.
- Microsoft Office vulnerabilities increased from 47 in 2024 to 157 in 2025, while critical vulnerabilities increased from 3 to 31.
- Azure and Dynamics 365 recorded 69 vulnerabilities in 2025; critical vulnerabilities increased from 4 in 2024 to 37, representing 54% of their 2025 total.
- Recommendations
- Prioritize patching using exploitation evidence, business impact, and environment-specific threat models; keep operating systems and third-party software updated and avoid end-of-life software.
- Remove standing administrative rights and enforce least privilege and just-in-time access across human identities, service accounts, and AI agents.
- Keep RDP off the public internet, enforce strong authentication and session monitoring, and replace or augment VPN access with zero trust controls.
- Implement Identity Threat Detection and Response with visibility into identity privileges, escalation paths, and suspicious activity across identity stores.
- Disable the preview pane to mitigate the preview-based vulnerabilities discussed in the report, and apply endpoint application control.
CVE
CVE-2025-21298they are compounded, as seen with CVE-2025-32711, CVE-2025-21298 and CVE-2025-65037, theyCVE-2025-32711CVE-2025-32711 – EchoLeak: A critical vulnerability in Microsoft 365 Copilot caused by weakCVE-2025-55241One token to own them all - CVE-2025-55241CVE-2025-59286CVE-2025-59286: Allows unauthorized attackers to perform command injection and discloseCVE-2025-62554The More-than-Remote Possibilities - CVE-2025-62557 & CVE-2025-62554CVE-2025-62557The More-than-Remote Possibilities - CVE-2025-62557 & CVE-2025-62554CVE-2025-65037When you lose the lid for the container – CVE-2025-65037
People
Bradley SmithBeyondTrust SVP and Deputy CISO who contributed commentary on identity infrastructure targeting and investment in security architecture and identity governance.David (DJ) MorimannoField CTO at Xalient who contributed commentary on identity attacks, non-human identities, and continuous trust validation.Dirk-jan MollemaResearcher credited with discovering CVE-2025-55241 and describing its cross-tenant token acceptance and tenant-separation failure.Jane FranklandFounder of the IN Security Movement and CEO of KnewStart who contributed commentary on patch prioritization, least privilege, internal monitoring, and AI agent governance.Katie MoussourisFounder and CEO of Luta Security who contributed commentary on the limitations of CVE counts and the importance of reducing administrative privilege.Kevin E. GreeneBeyondTrust Public Sector Chief Cybersecurity Technologist who advocated privilege disruption and governance of non-human identities.Marc MaiffretBeyondTrust Chief Technology Officer who contributed commentary on cloud identity vulnerabilities, excessive privilege, and unmonitored service accounts.Morey HaberBeyondTrust Chief Security Advisor quoted on the importance of distinguishing stable vulnerability totals from worsening critical vulnerability counts.Paula JanuszkiewiczCEO of CQURE Inc. and CQURE Academy who contributed commentary on misconfiguration, attack paths, segmentation, visibility, and identity governance.Sami LaihoSenior Technical Fellow at Adminize and Microsoft MVP who contributed commentary advocating least privilege, just-in-time access, and tighter control of identity infrastructure.
Vendors
Products
AzureTotal vulnerabilities in Azure and Dynamics plateaued in 2025, at 69, while critical vulnerabilitiesAzure Container AppsOrganizations are increasing their use of Azure Container Apps because it lets them runEntra IDAs a critical vulnerability in Azure Entra ID, CVE-2025-55241 could have enabled an attacker toMicrosoft 365 CopilotCVE-2025-32711 – EchoLeak: A critical vulnerability in Microsoft 365 Copilot caused by weakMicrosoft Dynamics 365Microsoft Azure and Dynamics 365 experienced a 9x rise in critical vulnerabilities,Microsoft Edgevulnerabilities of Microsoft Edge reached an all-time low, diminishing substantially from 292 toMicrosoft OfficeMicrosoft Office total vulnerabilities surged 234% year-on-year, from 47 to 157, and criticalMicrosoft Windowsrose sharply from 4 to 37—hitting a record high. Windows Server total vulnerabilities increasedWindows Serverrose sharply from 4 to 37—hitting a record high. Windows Server total vulnerabilities increased