![\"Microsoft](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2025\/11\/1763173991_148_0x0.jpg\")
<\/p>\n<\/p>\n
Update Windows now \u2014 attacks underway.<\/p>\n
NurPhoto via Getty Images<\/p>\n
Updated November 14 with details of further Microsoft Windows vulnerabilities that need to be addressed as a matter of some urgency, according to experts, notwithstanding the criticality of the already-exploited Windows Kernel CVE-2025-62215 issue.<\/p>\n
At the same time that Google was issuing an emergency update<\/a> for all Chrome browser users<\/a> in response to a high-severity security vulnerability, Microsoft issued a security warning of its own. A newly discovered zero-day<\/a> vulnerability in the Windows Kernel can enable an attacker to gain system privileges. Yes, a Windows kernel zero-day. Yes, attackers have already struck. Yes, you need to update now.<\/p>\n ForbesAll Microsoft Windows Users Warned As New Bot Attacks ConfirmedBy Davey Winder<\/a>Update Windows Now As Microsoft Confirms Kernel Zero-Day Attacks<\/p>\n The latest chapter in the never-ending cybersecurity drama<\/a> that is Patch Tuesday has been released, and this time it contains no less than 63 vulnerabilities. There\u2019s one, though, that stands out: CVE-2025-62215, an actively exploited zero-day within the Windows Kernel itself. <\/p>\n \u201cWhile exploitation requires an attacker to win a race condition,\u201d Satnam Narang, a senior staff research engineer at Tenable, said, \u201cMicrosoft confirmed that this vulnerability has been actively exploited in the wild.\u201d Narang suggested that this was most likely, considering that CVE-2025-62215 is a privilege escalation flaw, \u201cused as part of post-exploitation activity, following initial access via phishing, social engineering, or another vulnerability.\u201d<\/p>\n While the official Microsoft security advisory<\/a> confirmed that \u201cconcurrent execution using shared resource with improper synchronization (‘race condition’) in Windows Kernel allows an authorized attacker to elevate privileges locally,\u201d and that exploitation in the wild had been detected, others have gone further by way of digging into the Windows Kernel vulnerability. <\/p>\n ForbesAmazon CISO Confirms Hacker Exploit Used 2 Zero-Day AttacksBy Davey Winder<\/a><\/p>\n \u201cIt\u2019s likely to affect just about every asset running Microsoft software,\u201d Adam Barnett, lead software engineer at Rapid7, told me, adding that \u201dif all the stars align for the attacker, the prize could be remote code execution as system via the network without any need for an existing foothold.\u201d The good news, aside from the fix being available, is that Barnett doesn\u2019t think CVE-2025-62215 is wormable, but that doesn\u2019t stop him from advising that it remains \u201ca top priority for just about anyone considering how to approach this month\u2019s patches.\u201d<\/p>\n The root cause, as confirmed by Microsoft itself, appears to be CWE-362<\/a>: Concurrent Execution using Shared Resource with Improper Synchronization and CWE-415<\/a>: Double Free. The two conditions combined, Ben McCarthy, lead cyber security engineer at Immersive, warns, mean that \u201can attacker with low-privilege local access can run a specially crafted application that repeatedly attempts to trigger this race condition. The goal is to get multiple threads to interact with a shared kernel resource in an unsynchronised way, confusing the kernel’s memory management and causing it to free the same memory block twice.\u201d This then corrupts the kernel heap, the attacker overwrites memory, and the system execution flow is hijacked. Translation: you are in trouble, lots of it. As Jason Soroko, senior fellow at Sectigo, concluded, \u201cCVE-2025-62215 does not open the door by itself, it flings it wide once an attacker is inside.\u201d<\/p>\n