Patch Tuesday: December 2025 (Expel’s version)

Threat intel · 5 MIN READ · BEN NAHORNEY AND MATT JASTRAM · DEC 10, 2025 · TAGS: vulnerability prioritization

TL;DR

• December’s Patch Tuesday includes 57 CVEs, with one actively exploited zero-day vulnerability (CVE-2025-62221) that allows privilege escalation to SYSTEM and has been added to CISA’s KEV catalog.
• Two additional publicly disclosed zero-days affect GitHub Copilot (CVE-2025-64671) and PowerShell (CVE-2025-54100), both enabling code execution and requiring immediate patching.
• EPSS scores experienced massive volatility in late November with nearly 5,000 CVEs seeing score changes of +10% or more over a two day period, demonstrating the importance of monitoring exploit likelihood alongside traditional exploitation evidence.

As we wrap up 2025, December’s Patch Tuesday has arrived. With many teams preparing for holiday schedules, it’s important to address critical vulnerabilities before everyone winds down for the year. So while you’re making your (patching) list and checking it twice, here are the CVEs we think deserve prioritization.

Patch Tuesday: December 9, 2025

This month’s release includes 57 CVEs, including three zero-day vulnerabilities, one of which is actively being exploited in the wild. There are also three Critical remote code execution (RCE) vulnerabilities in this batch.

• Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVE-2025-62221): This use-after-free (UAF) vulnerability has been actively exploited in the wild. The flaw resides in the Windows Cloud Files Mini Filter Driver (cldflt.sys), used by OneDrive and other cloud sync clients. This driver runs at the kernel level with SYSTEM privileges, making UAF vulnerabilities particularly concerning. An attacker with low-level privilege can leverage this vulnerability to escalate their permissions to SYSTEM, gaining control of the vulnerable system. This vulnerability has a CVSS score of 7.8 and has been added to the Known Exploited Vulnerability (KEV) catalog. 
• GitHub Copilot for Jetbrains Remote Code Execution Vulnerability (CVE-2025-64671): This is a publicly disclosed vulnerability dubbed “IDEsaster” by security research Ari Marzuk who discovered it. It impacts developers using GitHub Copilot with the JetBrains IDE, taking advantage of a feature that allows certain commands to be executed without prompting the user each time. In an attack, a bad actor could append unapproved commands onto an auto-approved command, resulting in automatic execution on the local system.
• PowerShell Remote Code Execution Vulnerability (CVE-2025-54100): This vulnerability affects PowerShell’s handling of web content. When PowerShell fetches a webpage that contains an embedded script, it may inadvertently execute that code rather than just retrieve it. In such a case, that code will be executed with the same permissions as the user that ran the PowerShell command. Microsoft hasn’t patched this per-se, but has added a warning to the user, recommending they use basic parsing to avoid inadvertent execution. We ourselves recommend restricting which users can use PowerShell. Many of today’s attacks trick users into executing PowerShell, and it’s best to cut off that avenue of exploitation by principle of least privilege (PoLP).
• Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVE-2025-64678): This vulnerability in the Routing and Remote Access Service (RASS) is particularly concerning since this service is often involved with handling VPN traffic, and sits at the network perimeter. This is a heap-based buffer overflow, where an attacker can send specially crafted packets that, when picked up by RRAS, overwrite adjacent memory due to improper validation. This could allow a threat actor to hijack control flow, and potentially run arbitrary code through the RRAS process, which runs as SYSTEM.

The winds of change: EPSS November score fluctuations and vulnerability exploit risk factors  

As many geared up for Thanksgiving weekend, Exploit Prediction Scoring System (EPSS) was extremely busy identifying thousands of CVEs with a +10% or more higher risk score increase! EPSS is a data-driven effort for estimating the likelihood (probability) that a vulnerability will be exploited in the wild in the next 30 days. The higher the score, the more likely a threat actor will leverage it. Many vulnerability scanning technologies have adopted the EPSS scoring trained model, and the integrations are in their user interfaces. The EPSS model is used to leverage current CVE threat information and a mix of real-world exploit data factors. 

The question is, why was there a significant EPSS score volatility on these two dates in November? There was’nt an EPSS public statement. However, one could theorize EPSS scores were recalibrated with a combination of multiple exploitation events and critical intelligence feeds to ultimately normalize scores for their individual CVE model. 

The ultimate goal of EPSS usage is to demonstrate exploit risk factors and highlight critical threats to help responsible IT teams prioritize vulnerability remediation.

So, how many EPSS score fluctuations of +10% or more did we see in late November? Well, on November 18 there were 2,677, and then on November 21 there were another 2,155. The total CVE model impacted a total of 4,832 scores. There were a few patterns (listed below), but the November 21 data changes actually recalibrated some of the original November 18 changes. In some cases, large fluctuations were reversed to ensure actual scores were more accurate. Still, 4,832 changes are challenging to keep up with, but the shift demonstrated many vulnerabilities should be prioritized with more urgency. Overall, the EPSS score fluctuations, combined with evidence of exploitation risk in the wild, continue to demonstrate the risk factors needed to drive vulnerability remediation action.

Below are some highlighted EPSS scoring trends for these two days, and some trends we’ve noticed over the last couple of months. 

Since thousands of changes occurred over the two-day period, we reviewed some of the major ‘high’ scores (85%-94%) in the table below. The table is built using risk factors, which help us identify and prioritize vulnerability remediation. 

Note: The EPSS scores are regularly fluctuating. Some may have even changed since the time of our analysis. 

Identifying exploit risk factors and taking action on vulnerability remediation demonstrates maturity in your company’s vulnerability management program. It’s critical to monitor exploit risk factors to ensure you’re addressing exploit risk before threat actors do. Please reach out if you have any questions or would like to discuss simple practices to address vulnerability exploit risk in your infrastructure.