Microsoft · Security update · December 9, 2025

KB5071501: December 2025 security update

KB5071501, released December 9, 2025, fixes 10 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.

Urgent1 publicly disclosedUnsupported product
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
3
Vendor assessment
Highest EPSS
0.0223
82nd percentile

Priority of the 10 CVEs

Patch now 0 Urgent 3 High 6 Routine 1

Applies to

Product
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Urgent CVE-2025-62472 Windows Remote Access Connection Manager Elevation of Privilege 7.8 0.0220 More likely
Urgent CVE-2025-62458 Windows Win32K - GRFX Elevation of Privilege 7.8 0.0066 More likely
Urgent CVE-2025-62470 Windows Common Log File System Driver Elevation of Privilege 7.8 0.0051 More likely
High CVE-2025-54100 Windows PowerShell Remote Code Execution 7.8 0.0223 DisclosedExploitation Less Likely
High CVE-2025-62549 Windows Routing and Remote Access Service (RRAS) Remote Code Execution 8.8 0.0132 Exploitation Less Likely
High CVE-2025-62455 Windows Message Queuing Elevation of Privilege 7.8 0.0047 Exploitation Less Likely
High CVE-2025-62466 Windows Client-Side Caching (CSC) Service Elevation of Privilege 7.8 0.0040 Exploitation Less Likely
High CVE-2025-62571 Windows Installer Elevation of Privilege 7.8 0.0040 Exploitation Less Likely
High CVE-2025-62474 Windows Remote Access Connection Manager Elevation of Privilege 7.8 0.0037 Exploitation Less Likely
Routine CVE-2025-62473 Windows Routing and Remote Access Service (RRAS) Information Disclosure 6.5 0.0108 Exploitation Less Likely
Showing 1 to 10 of 10 1