Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation

Microsoft disclosed 1,273 vulnerabilities in 2025, a slight dip from the 1,360 reported in 2024. While the overall volume looks steady, the critical‑severity count jumped from 78 to 157, reversing a multi‑year downward trend. That shift is the headline that security teams should watch.

---

Where the risk is concentrating

“The danger isn’t the number of bugs; it’s where they live and what they enable,” says Morey J. Haber, Chief Security Advisor at BeyondTrust.

Elevation‑of‑Privilege (EoP) flaws now represent 40 % of all Microsoft CVEs, and information‑disclosure bugs rose 73 % year‑over‑year. Attackers are favoring stealth and reconnaissance over noisy exploits. A single EoP bug can turn a low‑privilege account into a domain admin, opening the door for lateral movement, credential dumping, and “Living‑off‑the‑Land” techniques.

Cloud platforms under pressure

Azure and Dynamics 365 saw total vulnerability counts dip slightly, yet critical flaws surged from 4 to 37. In a cloud‑first environment, a critical flaw in the control plane can shut down entire business workflows in minutes.

“A mis‑configured Azure Entra ID tenant is equivalent to handing an attacker the master key to every SaaS app you run,” notes James Maude, Field CTO at BeyondTrust.

The report cites CVE‑2025‑55241, a critical Entra ID token‑forgery bug patched in July 2025, which allowed attackers to create tokens accepted across any tenant without leaving logs.

Servers, endpoints, and productivity software

• Windows Server: 780 vulnerabilities, 50 classified critical.
• Microsoft Office: total vulnerabilities rose 234 % (47 → 157); critical bugs jumped 10× (3 → 31).

Office remains a prime entry point because of macros, document preview panes, AI‑driven content generation, and third‑party add‑ins. Seven CVEs in 2025 leveraged the Windows preview pane to execute code silently.

What this means for defenders

1. Prioritize blast‑radius reduction – audit admin rights, service accounts, and AI agents. Treat non‑human identities with the same scrutiny as human users.
2. Map vulnerabilities to ATT&CK – focus on techniques that enable privilege escalation, credential access, and lateral movement rather than CVSS alone.
3. Enforce least‑privilege across cloud – use Azure AD Conditional Access, Just‑In‑Time (JIT) elevation, and continuous identity analytics to spot abnormal token use.
4. Disable high‑risk UI features – turn off the Windows preview pane and restrict macro execution in Office until a proven need exists.
5. Integrate AI security posture management – monitor AI agents for abnormal behavior, enforce credential isolation, and apply runtime protection.

“Patch velocity is no longer enough. You need context, exploitability data, and a privilege‑reduction mindset,” Haber adds.

Practical steps to tighten security today

• Run a privileged‑account inventory: Identify all admin, service, and AI identities. Verify each has a documented business justification and MFA enabled.
• Deploy a cloud‑native CSPM/CIEM solution: Tools like BeyondTrust Privilege Management or Azure AD Identity Protection can surface over‑privileged accounts and risky configurations in real time.
• Implement micro‑segmentation: Limit lateral movement by restricting network flows between workloads, especially between Azure control‑plane services and tenant resources.
• Adopt a risk‑based patching cadence: Prioritize EoP and information‑disclosure CVEs that affect identity services, then move to lower‑severity bugs.
• Educate end users on Office threats: Conduct phishing simulations that include malicious Office documents, and enforce macro block policies.

Looking ahead

The 2026 Microsoft Vulnerabilities Report underscores a hard truth: attackers are no longer pounding on the front door; they are slipping in through privileged windows. Organizations that focus on reducing privilege, improving identity visibility, and continuously assessing risk will see fewer successful breaches, even if the headline vulnerability count appears stable.

---

Download the full 2026 Microsoft Vulnerabilities Report to explore detailed charts, CVE breakdowns, and additional mitigation guidance.

Authors: Morey J. Haber, Chief Security Advisor, BeyondTrust; James Maude, Field Chief Technology Officer, BeyondTrust.