Microsoft · Security update · May 13, 2025
KB5058454: May 2025 security update
KB5058454, released May 13, 2025, fixes 29 CVEs across 2 products. 3 of them are being exploited (CVE-2025-30397); 3 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.
Patch now3 on CISA KEVUnsupported product
CVEs closed
29
3 rated Critical
Exploited
3
CVE-2025-30397
Exploitation more likely
3
Vendor assessment
Highest EPSS
0.2726
98th percentile
Priority of the 29 CVEs
Patch now 3
Urgent 6
High 5
Routine 15
Applies to
| Product |
|---|
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2025-30397 | Microsoft Scripting Engine | Remote Code Execution | 7.5 | 0.2726 | KEVExploited |
| Patch now | CVE-2025-32706 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0233 | KEVExploited |
| Patch now | CVE-2025-32701 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0142 | KEVExploited |
| Urgent | CVE-2025-30388 | Windows Win32K - GRFX | Remote Code Execution | 7.8 | 0.0438 | More likely |
| Urgent | CVE-2025-29966 | Windows Remote Desktop | Remote Code Execution | 8.8 | 0.0143 | Exploitation Less Likely |
| Urgent | CVE-2025-29967 | Remote Desktop Gateway Service | Remote Code Execution | 8.8 | 0.0134 | Exploitation Less Likely |
| Urgent | CVE-2025-32710 | Windows Remote Desktop Services | Remote Code Execution | 8.1 | 0.0108 | Exploitation Less Likely |
| Urgent | CVE-2025-24063 | Windows Kernel | Elevation of Privilege | 7.8 | 0.0072 | More likely |
| Urgent | CVE-2025-30385 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0053 | More likely |
| High | CVE-2025-29962 | Windows Media | Remote Code Execution | 8.8 | 0.1559 | Exploitation Less Likely |
| High | CVE-2025-29969 | Windows Fundamentals | Remote Code Execution | 7.5 | 0.0116 | Exploitation Less Likely |
| High | CVE-2025-29831 | Remote Desktop Gateway Service | Remote Code Execution | 7.5 | 0.0101 | Exploitation Unlikely |
| High | CVE-2025-47955 | Windows Remote Access Connection Manager | Elevation of Privilege | 7.8 | 0.0091 | Exploitation Less Likely |
| High | CVE-2025-32707 | Windows NTFS | Elevation of Privilege | 7.8 | 0.0056 | Exploitation Less Likely |
| Routine | CVE-2025-29968 | Active Directory Certificate Services (AD CS) | Denial of Service | 6.5 | 0.0203 | Exploitation Unlikely |
| Routine | CVE-2025-29959 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0153 | Exploitation Unlikely |
| Routine | CVE-2025-29960 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0153 | Exploitation Unlikely |
| Routine | CVE-2025-29954 | Windows LDAP - Lightweight Directory Access Protocol | Denial of Service | 5.9 | 0.0148 | Exploitation Unlikely |
| Routine | CVE-2025-29958 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0145 | Exploitation Unlikely |
| Routine | CVE-2025-29961 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0145 | Exploitation Unlikely |
| Routine | CVE-2025-29836 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0141 | Exploitation Unlikely |
| Routine | CVE-2025-29830 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0138 | Exploitation Unlikely |
| Routine | CVE-2025-29832 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0138 | Exploitation Unlikely |
| Routine | CVE-2025-29835 | Windows Routing and Remote Access Service (RRAS) | Information Disclosure | 6.5 | 0.0138 | Exploitation Unlikely |
| Routine | CVE-2025-29956 | Windows SMB | Information Disclosure | 5.4 | 0.0112 | Exploitation Unlikely |
Showing 1 to 25 of 29
1Next