آپدیت امنیتی ماه نوامبر ۲۰۲۵ مایکروسافت که شامل به‌روزرسانی‌های امنیتی برای ۶۳ آسیب پذیری، از جمله یک آسیب‌پذیری Zero-day که به‌طور فعال مورد سوءاستفاده قرار می‌گیرد، منتشر شده است.
این به روز رسانی همچنین چهار آسیب‌پذیری «بحرانی» را برطرف می‌کند که دو مورد از آن‌ها آسیب‌پذیری‌های اجرای کد از راه دور، یکی مربوط به افزایش امتیاز و دیگری مربوط به افشای اطلاعات است.
تعداد آسیب پذیری ها در هر دسته به ترتیب زیر است:
- 29 Elevation of Privilege Vulnerabilities
- 2 Security Feature Bypass Vulnerabilities
- 16 Remote Code Execution Vulnerabilities
- 11 Information Disclosure Vulnerabilities
- 3 Denial of Service Vulnerabilities
- 2 Spoofing Vulnerabilities
همچنین این آپدیت اولین extended security update (ESU) برای ویندوز ۱۰ است، بنابراین اگر هنوز از این سیستم عامل پشتیبانی نشده استفاده می‌کنید، توصیه می‌شود که به ویندوز ۱۱ ارتقا دهید.
یک آسیب‌پذیری Zero-day فعال در حال بهره برداری
در آپدیت امنیتی این ماه، یک آسیب پذیری Zero-day فعال مورد سوءاستفاده در هسته ویندوز توسط مایکروسافت برطرف شده است.
این آسیب پذیری Zero-day با شماره شناسایی CVE-2025-62215 یک آسیب‌پذیری ارتقاء امتیاز کرنل ویندوز است.
مایکروسافت توضیح می‌دهدکه اجرای همزمان با استفاده از منابع مشترک و همگام‌سازی نامناسب در کرنل ویندوز به یک مهاجم اجازه می‌دهد تا امتیازات را به صورت محلی افزایش دهد. بهره برداری از این آسیب پذیری مستلزم آن است که مهاجم دارای امتیازات سطح SYSTEM باشد.
آپدیت های این ماه سایر شرکت ها
- Adobe released security updates for InDesign, InCopy, PhotoShop, Illustrator, Substance 3D, Pass, and Adobe Format.
- Cisco released patches for multiple products, including Cisco ASA, Unified Contact Center, and Identity services. Cisco also warned this month that a new attack was discovered exploiting older flaws.
- expr-eval developers released patches to fix a critical RCE in the JavaScript library.
- Fortinet released a security update for a medium-severity elevation of privileges flaw in FortiOS.
- Google has released the Android’s November security bulletin with fixes for two vulnerabilities.
- Ivanti released security patches as part of its November 2025 Patch Tuesday updates.
- runC security updates fix flaws allowing attackers to escape Docker and Kubernetes containers.
- QNAP released security updates for seven zero-day vulnerabilities exploited to hack network-attached storage (NAS) devices during the Pwn2Own Ireland 2025 hacking contest.
- SAP released the November security updates for multiple products, including a fix for a 10/10 harcoded credentials flaw in SQL Anywhere Monitor.
- Samsung released its November security updates with fixes for 25 flaws.
لیست کامل آپدیت امنیتی ماه نوامبر 2025 مایکروسافت
در ادامه لیست کاملی از آسیب‌پذیری‌های برطرف‌شده در آپدیت امنیتی ماه نوامبر ۲۰۲۵ آمده است.
| Tag | CVE ID | CVE Title | Severity |
| Azure Monitor Agent | CVE-2025-59504 | Azure Monitor Agent Remote Code Execution Vulnerability | Important |
| Customer Experience Improvement Program (CEIP) | CVE-2025-59512 | Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability | Important |
| Dynamics 365 Field Service (online) | CVE-2025-62211 | Dynamics 365 Field Service (online) Spoofing Vulnerability | Important |
| Dynamics 365 Field Service (online) | CVE-2025-62210 | Dynamics 365 Field Service (online) Spoofing Vulnerability | Important |
| GitHub Copilot and Visual Studio Code | CVE-2025-62453 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | Important |
| Host Process for Windows Tasks | CVE-2025-60710 | Host Process for Windows Tasks Elevation of Privilege Vulnerability | Important |
| Microsoft Configuration Manager | CVE-2025-47179 | Configuration Manager Elevation of Privilege Vulnerability | Important |
| Microsoft Dynamics 365 (on-premises) | CVE-2025-62206 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2025-60724 | GDI+ Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2025-62216 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2025-62199 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2025-62200 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62201 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60726 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62203 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62202 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60727 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60728 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-59240 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-62204 | Microsoft SharePoint Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2025-62205 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Streaming Service | CVE-2025-59514 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | Important |
| Microsoft Wireless Provisioning System | CVE-2025-62218 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | Important |
| Microsoft Wireless Provisioning System | CVE-2025-62219 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | Important |
| Multimedia Class Scheduler Service (MMCSS) | CVE-2025-60707 | Multimedia Class Scheduler Service (MMCSS) Driver Elevation of Privilege Vulnerability | Important |
| Nuance PowerScribe | CVE-2025-30398 | Nuance PowerScribe 360 Information Disclosure Vulnerability | Critical |
| OneDrive for Android | CVE-2025-60722 | Microsoft OneDrive for Android Elevation of Privilege Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2025-60706 | Windows Hyper-V Information Disclosure Vulnerability | Important |
| SQL Server | CVE-2025-59499 | Microsoft SQL Server Elevation of Privilege Vulnerability | Important |
| Storvsp.sys Driver | CVE-2025-60708 | Storvsp.sys Driver Denial of Service Vulnerability | Important |
| Visual Studio | CVE-2025-62214 | Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio Code CoPilot Chat Extension | CVE-2025-62449 | Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability | Important |
| Visual Studio Code CoPilot Chat Extension | CVE-2025-62222 | Agentic AI and Visual Studio Code Remote Code Execution Vulnerability | Important |
| Windows Administrator Protection | CVE-2025-60721 | Windows Administrator Protection Elevation of Privilege Vulnerability | Important |
| Windows Administrator Protection | CVE-2025-60718 | Windows Administrator Protection Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-62217 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-60719 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-62213 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Bluetooth RFCOM Protocol Driver | CVE-2025-59513 | Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability | Important |
| Windows Broadcast DVR User Service | CVE-2025-59515 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | Important |
| Windows Broadcast DVR User Service | CVE-2025-60717 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | Important |
| Windows Client-Side Caching (CSC) Service | CVE-2025-60705 | Windows Client-Side Caching Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-60709 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows DirectX | CVE-2025-59506 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | Important |
| Windows DirectX | CVE-2025-60716 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | Critical |
| Windows DirectX | CVE-2025-60723 | DirectX Graphics Kernel Denial of Service Vulnerability | Important |
| Windows Kerberos | CVE-2025-60704 | Windows Kerberos Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2025-62215 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows License Manager | CVE-2025-62208 | Windows License Manager Information Disclosure Vulnerability | Important |
| Windows License Manager | CVE-2025-62209 | Windows License Manager Information Disclosure Vulnerability | Important |
| Windows OLE | CVE-2025-60714 | Windows OLE Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2025-60703 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-62452 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-59510 | Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-60715 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-60713 | Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability | Important |
| Windows Smart Card | CVE-2025-59505 | Windows Smart Card Reader Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59507 | Windows Speech Runtime Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59508 | Windows Speech Recognition Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59509 | Windows Speech Recognition Information Disclosure Vulnerability | Important |
| Windows Subsystem for Linux GUI | CVE-2025-62220 | Windows Subsystem for Linux GUI Remote Code Execution Vulnerability | Important |
| Windows TDX.sys | CVE-2025-60720 | Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability | Important |
| Windows WLAN Service | CVE-2025-59511 | Windows WLAN Service Elevation of Privilege Vulnerability | Important |
منبع:
