Microsoft · Security update · April 8, 2025

KB5055609: April 2025 security update

KB5055609, released April 8, 2025, fixes 39 CVEs across 4 products. One of them is being exploited (CVE-2025-29824); 1 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now1 on CISA KEVKnown ransomware useUnsupported product
CVEs closed
39
3 rated Critical
Exploited
1
CVE-2025-29824
Exploitation more likely
3
Vendor assessment
Highest EPSS
0.1925
97th percentile

Priority of the 39 CVEs

Patch now 1 Urgent 4 High 25 Routine 9

Applies to

Product
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2025-29824 Windows Common Log File System Driver Elevation of Privilege 7.8 0.1925 KEVRansomwareExploited
Urgent CVE-2025-26670 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution 8.1 0.1105 More likely
Urgent CVE-2025-26663 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution 8.1 0.0179 More likely
Urgent CVE-2025-26686 Windows TCP/IP Remote Code Execution 7.5 0.0142 Exploitation Less Likely
Urgent CVE-2025-27727 Windows Installer Elevation of Privilege 7.8 0.0104 More likely
High CVE-2025-21204 Windows Update Stack Elevation of Privilege 7.8 0.0713 Exploitation Less Likely
High CVE-2025-27740 Windows Active Directory Certificate Services Elevation of Privilege 8.8 0.0352 Exploitation Less Likely
High CVE-2025-26673 Windows LDAP - Lightweight Directory Access Protocol Denial of Service 7.5 0.0273 Exploitation Less Likely
High CVE-2025-29810 Active Directory Domain Services Elevation of Privilege 7.5 0.0262 Exploitation Less Likely
High CVE-2025-27469 Windows LDAP - Lightweight Directory Access Protocol Denial of Service 7.5 0.0257 Exploitation Less Likely
High CVE-2025-26647 Windows Kerberos Elevation of Privilege 8.8 0.0230 Exploitation Less Likely
High CVE-2025-26641 Windows Cryptographic Services Denial of Service 7.5 0.0227 Exploitation Less Likely
High CVE-2025-27473 Windows HTTP.sys Denial of Service 7.5 0.0227 Exploitation Less Likely
High CVE-2025-27477 Windows Telephony Service Remote Code Execution 8.8 0.0161 Exploitation Less Likely
High CVE-2025-26669 Windows Routing and Remote Access Service (RRAS) Information Disclosure 8.8 0.0153 Exploitation Less Likely
High CVE-2025-21205 Windows Telephony Service Remote Code Execution 8.8 0.0139 Exploitation Less Likely
High CVE-2025-21221 Windows Telephony Service Remote Code Execution 8.8 0.0139 Exploitation Less Likely
High CVE-2025-21222 Windows Telephony Service Remote Code Execution 8.8 0.0139 Exploitation Less Likely
High CVE-2025-27481 Windows Telephony Service Remote Code Execution 8.8 0.0127 Exploitation Less Likely
High CVE-2025-26668 Windows Routing and Remote Access Service (RRAS) Remote Code Execution 7.5 0.0126 Exploitation Less Likely
High CVE-2025-26687 Windows Win32K - GRFX Elevation of Privilege 7.5 0.0116 Exploitation Less Likely
High CVE-2025-27484 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege 7.5 0.0083 Exploitation Less Likely
High CVE-2025-27741 Windows NTFS Elevation of Privilege 7.8 0.0082 Exploitation Less Likely
High CVE-2025-27737 Windows Security Zone Mapping Security Feature Bypass 8.6 0.0078 Exploitation Less Likely
High CVE-2025-27733 Windows NTFS Elevation of Privilege 7.8 0.0074 Exploitation Less Likely
Showing 1 to 25 of 39 1Next