April 2025 Patch Tuesday comes with fixes for 134 Vulnerabilities including 1 Actively Exploited Zero-Day

April may fool your systems with Vulnerabilities, but you can stay foolproof by patching your systems regularly. This month’s Patch Tuesday delivers 134 security fixes, including one actively exploited zero-day and 11 critical vulnerabilities.

Let's dive into what's new in this year's fourth Patch Tuesday. Also, register for our free Patch Tuesday webinar and listen to our experts break down Patch Tuesday updates in detail.

April 2025 Security Updates Lineup

Total CVEs fixed: 134
Zero-day vulnerabilities: 1 (Actively Exploited)
Critical vulnerabilities: 11 (all Remote Code Execution)
Republished CVEs: 9 (refer to the MSRC Release Notes)

Fun fact: While Microsoft has fixed 134 bugs, this doesn’t include 13 Microsoft Edge vulnerabilities fixed earlier this month—because even browsers need a little spring cleaning.

Affected Products, Features, and Roles

Security updates have been released for critical Microsoft products, including:

Windows 11 and Windows Server
Microsoft Office
Azure Kubernetes Service
Microsoft Dynamics
Windows Common Log File System (CLFS) Driver

To view the complete list of affected products, features, and roles, please refer to the MSRC Release Notes

Vulnerability Breakdown

Here’s how this month’s vulnerabilities are distributed:

49 Elevation of Privilege (EoP) – When hackers want an upgrade, but not the legal kind.
9 Security Feature Bypass (SFB) – Because sometimes, security doors forget to lock themselves.
31 Remote Code Execution (RCE) – The cybercriminal’s version of “working from home.”
17 Information Disclosure – Spilling secrets where they shouldn’t be spilled.
14 Denial of Service (DoS) – Bringing services down, one crash at a time.
3 Spoofing – Digital identity theft, but make it sneakier.

Bottom line? Remote Code Execution (RCE) is the biggest concern this month, making up all 11 of the critical vulnerabilities.

Zero-Day Vulnerability Details

CVE-2025-29824
Vulnerable Component: Windows CLFS Driver
Impact: Elevation of Privilege (EoP)
CVSS 3.1: 7.8
Actively Exploited? Yes

This zero-day vulnerability allows local attackers to gain SYSTEM privileges on targeted devices. That’s as high as it gets—meaning an attacker can take full control of the system.

Microsoft has released patches for Windows 11 and Windows Server, but Windows 10 users will have to wait a little longer for their fix. While we don’t have details on how attackers are exploiting this flaw, Microsoft attributes its discovery to the Microsoft Threat Intelligence Center.

If you are on Windows 10, keep an eye out for updates and apply them as soon as they drop.

Update: The security updates for Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems are now available.

Third-Party Security Updates

It’s not just Microsoft—other vendors are tightening security this month too:

Apache patched a maximum severity RCE flaw in Apache Parquet.
Apple backported fixes for actively exploited vulnerabilities to older devices.
Google patched 62 Android vulnerabilities, including two zero-days under active attack.
Ivanti fixed a critical Connect Secure RCE flaw exploited by Chinese threat actors.
Fortinet addressed a critical flaw allowing attackers to change admin passwords in FortiSwitch.
MikroTik released fixes as part of its April 2025 security bulletin.
Minio urged users to update due to an "incomplete signature validation" vulnerability.
SAP released updates for multiple products, including three critical flaws.
WinRAR fixed a bug preventing Mark of the Web updates from propagating to extracted files.

Takeaway: Even if you’re patched against Microsoft vulnerabilities, don’t forget third-party software—it’s just as critical!

134 Vulnerabilities is no small number and adding to the fact there is one actively exploited zero day in the loose, the avalanche doesn’t wait for you to move. Patch your systems promptly before it gains the momentum. With Endpoint Central, Patch Manager Plus and Vulnerability Manager Plus, you can streamline the entire patch management process— from testing patches to deploying them— effectively mitigating vulnerabilities. You can also tailor patch tasks according to your enterprise needs.