Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

June 2025 Patch Tuesday: Exploited WebDAV Flaw & Office Risks

Fortra
05/12/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


and I'm here to talk to you about this month's Patch Tuesday. There's not a lot I'm going to talk about, there's just two things I want to touch on, so we'll just jump right into those. The first thing I want to talk to you about is CVE-2025-33053. This is the one CVE that Microsoft listed as exploit detected. There's a great blog post out there from Checkpoint if you want to check it out, with all the details on this vulnerability, but essentially what it is, is a .URL shortcut file that links to a WebDAV server and allows for code execution. So take a look at the blog post, make sure you're updated for this one, because it is seeing active exploitation. The other thing I want to touch on is the four Office updates, specifically Microsoft Office 365, that are all preview pane affected. I'm not going to list the CVEs, because there are a bunch of them, but they're all the Office ones. Whenever you see preview pane affected, that means that when you receive an email, if your preview is turned on, the exploit has a chance to run immediately without any interaction from you. One of the big things here is that the Microsoft 365 Office client specifically does not have updates available yet. So we'll have to wait for Microsoft to release those. Thankfully, there are no exploits at the moment for these, so the risk is relatively low, but something to keep in mind and keep an eye out for those updates when they do get released in the future. Once again, I'm Tyler Reguli, and this has been your June Patch Tuesday update. Thank you. Microsoft Mechanics www.microsoft.com

TL;DR

  • CVE-2025-33053 is actively exploited in the wild, involving malicious .URL shortcut files that link to WebDAV servers to achieve code execution—immediate patching is critical.
  • Four Microsoft Office 365 vulnerabilities are preview pane-affected, meaning exploits could trigger automatically when emails are opened without any user interaction required.
  • Microsoft 365 Office client patches are not yet available for the preview pane vulnerabilities, though no active exploits currently exist, creating a window of exposure to monitor.

Summary

Tyler Reguly, Associate Director of Security R&D at Fortra, provides a focused analysis of June 2025's Microsoft Patch Tuesday, highlighting two critical areas requiring immediate attention from security teams. The briefing covers an actively exploited vulnerability involving .URL shortcut files and WebDAV servers (CVE-2025-33053), which has been documented by Checkpoint researchers and requires urgent patching. Additionally, Reguly addresses four Microsoft Office 365 vulnerabilities that are preview pane-affected, meaning they could execute without user interaction when emails are opened. Notably, patches for the Microsoft 365 Office client are not yet available, creating a temporary exposure window that defenders should monitor. This concise update helps security practitioners prioritize their patching efforts for the month and understand the specific risks associated with each vulnerability class.

Chapters

0:00 - Introduction
0:13 - CVE-2025-33053 Actively Exploited
0:45 - Office 365 Preview Pane Vulnerabilities
1:34 - Closing

Key Quotes

0:18 "This is the one CVE that Microsoft listed as exploit detected."
0:30 "... a .URL shortcut file that links to a WebDAV server and allows for code execution."
1:06 "... if your preview is turned on, the exploit has a chance to run immediately without any interaction from you."

Categories:
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Vulnerability Management
  • Threat Intelligence
  • Email Security
  • Technical Deep Dive
  • Patch Tuesday
  • Microsoft Security Updates
  • CVE-2025-33053
  • WebDAV Exploitation
  • Office 365 Vulnerabilities
  • Preview Pane Attacks
  • Zero-Day Threats
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: June 2025 Patch Tuesday: Exploited WebDAV Flaw & Office Risks

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Nov
                  10

                  Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service

                  11/10/202601:00 PM ET
                  • Nov
                    12

                    Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                    11/12/202601:00 PM ET
                    More events

                    Industry Events (Sponsor Hosted)

                    • Nov
                      10

                      Agentic Shopping Trends: Insights for the 2026 Holiday Season

                      11/10/202601:00 PM ET
                      • Nov
                        12

                        Bridging On-Prem Data to Databricks Using MinIO AIStor in the Americas

                        11/12/202601:00 PM ET
                        • Nov
                          18

                          Practical Session: Connecting On-Prem Data to Databricks via MinIO AIStor

                          11/18/202608:00 AM ET
                          • Nov
                            19

                            Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

                            11/19/202601:00 PM ET
                            • Nov
                              19

                              A Deep Dive into Muse, Dots, and Duet's Impact on Your Website

                              11/19/202601:00 PM ET
                              More events

                              Upcoming Webinar Calendar

                              • 11/10/2026
                                01:00 PM
                                11/10/2026
                                Zendesk: From AI Readiness to Results: A Framework for Transforming IT Service
                                https://www.truthinit.com/index.php/channel/2191/zendesk-from-ai-readiness-to-results-a-framework-for-transforming-it-service/
                              • 11/10/2026
                                01:00 PM
                                11/10/2026
                                Agentic Shopping Trends: Insights for the 2026 Holiday Season
                                https://www.truthinit.com/index.php/channel/2219/agentic-shopping-trends-insights-for-the-2026-holiday-season/
                              • 11/12/2026
                                01:00 PM
                                11/12/2026
                                Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                                https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                              • 11/12/2026
                                01:00 PM
                                11/12/2026
                                Bridging On-Prem Data to Databricks Using MinIO AIStor in the Americas
                                https://www.truthinit.com/index.php/channel/2202/bridging-on-prem-data-to-databricks-using-minio-aistor-in-the-americas/
                              • 11/18/2026
                                08:00 AM
                                11/18/2026
                                Practical Session: Connecting On-Prem Data to Databricks via MinIO AIStor
                                https://www.truthinit.com/index.php/channel/2194/practical-session-connecting-on-prem-data-to-databricks-via-minio-aistor/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                                https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                                https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                              • 11/19/2026
                                01:00 PM
                                11/19/2026
                                A Deep Dive into Muse, Dots, and Duet's Impact on Your Website
                                https://www.truthinit.com/index.php/channel/2228/a-deep-dive-into-muse-dots-and-duets-impact-on-your-website/
                              • 12/03/2026
                                01:00 PM
                                12/03/2026
                                CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era
                                https://www.truthinit.com/index.php/channel/2231/ciso-insights-steering-cybersecurity-strategies-in-an-ai-driven-era/
                              • 01/19/2027
                                02:00 PM
                                01/19/2027
                                HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                                https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                              • 03/18/2027
                                01:00 PM
                                03/18/2027
                                360View: Securing Access for People, Partners and AI Agents
                                https://www.truthinit.com/index.php/channel/2251/securing-access-for-people-partners-and-ai-agents/
                              • 06/17/2027
                                01:00 PM
                                06/17/2027
                                360View: Stop the Leak: Data Loss Prevention for the AI Era
                                https://www.truthinit.com/index.php/channel/955/360view-stop-the-leak-data-loss-prevention-for-the-ai-era/
                              • 08/19/2027
                                01:00 PM
                                08/19/2027
                                Who Has Access to What...and Should They?
                                https://www.truthinit.com/index.php/channel/2252/who-has-access-to-what-and-should-they/
                              • 10/21/2027
                                01:00 PM
                                10/21/2027
                                After VMware: Building the Private Cloud You Actually Want
                                https://www.truthinit.com/index.php/channel/2253/after-vmware-building-the-private-cloud-you-actually-want/
                              • 11/18/2027
                                01:00 PM
                                11/18/2027
                                Assume Breach, Prove Recovery
                                https://www.truthinit.com/index.php/channel/2254/assume-breach-prove-recovery/
                              • 12/16/2027
                                01:00 PM
                                12/16/2027
                                The Self-Running Service Desk
                                https://www.truthinit.com/index.php/channel/2255/the-self-running-service-desk/
                              Truth in IT
                              • Sponsor
                              • About Us
                              • Terms of Service
                              • Privacy Policy
                              • Contact Us
                              • Preference Management
                              Desktop version
                              Standard version