December Patch Tuesday highlights active exploit risk and EPSS volatility

At a glance

What this is: This analysis of December’s Patch Tuesday argues that exploitability signals and active abuse should drive patch priority, not CVSS alone.

Why it matters: For IAM and security teams, the main lesson is that privilege escalation, code execution, and user-driven execution paths can become identity-adjacent control failures if remediation timing slips.

By the numbers:

• December’s Patch Tuesday includes 57 CVEs, including three zero-day vulnerabilities and one that is actively being exploited in the wild.
• The late-November EPSS update affected 4,832 CVE scores across two days.

👉 Read Expel’s analysis of December Patch Tuesday prioritisation and EPSS volatility

Context

Patch prioritisation fails when teams treat severity as the only sorting signal. This month’s Microsoft release shows why exploit evidence, privilege impact, and exposure context matter more than a raw CVSS score when choosing what to patch first, especially before holiday staffing reductions slow response.

Although the article is framed around vulnerabilities, it has a real identity dimension because one exploited flaw escalates to SYSTEM and the other two enable code execution on endpoints used for development and administration. That makes this more than a patch list: it is a reminder that local privilege, administrative workflows, and execution trust are part of identity governance, not just endpoint hygiene.

Key questions

Q: How should security teams prioritise vulnerabilities when EPSS changes quickly?

A: Use EPSS as a live probability signal, not as a standalone decision engine. Combine it with KEV status, proof-of-concept availability, exploit chatter, and asset criticality. When scores move sharply, re-rank remediation immediately rather than waiting for the next patch cycle, because exploit likelihood can change faster than scheduled governance reviews.

Q: Why do privilege escalation flaws create broader security risk than ordinary endpoint bugs?

A: Privilege escalation flaws change the attacker’s authority, not just their access. Once an exploit reaches SYSTEM or local admin, the attacker can disable controls, pivot into sensitive tools, and impersonate trusted processes. That makes the issue identity-adjacent, because the core question becomes which authority the attacker can borrow after compromise.

Q: What do teams get wrong about developer tooling and code execution risk?

A: Teams often trust developer tools because they are part of normal workflows, but that trust can be abused when auto-approval, plugins, or embedded scripts execute unreviewed commands. The safe assumption is that any tool able to run code should be governed like a privileged execution surface, with explicit boundaries and monitoring.

Q: How should organisations respond when a critical vulnerability is already being exploited?

A: Containment comes first. Isolate exposed systems, remove or restrict the risky execution path, validate whether the vulnerable component is in use, and then patch based on exposure and privilege impact. If the issue affects administrative or scripting workflows, treat it as a high-priority identity and endpoint control failure, not just a software update.

Technical breakdown

Why active exploitability changes patch order

Patch programmes usually rank issues by severity, but exploitability changes the order materially. CVSS tells you potential impact, while KEV status, EPSS, proof of concept activity, and observed exploitation tell you whether attackers are already operationalising the flaw. A vulnerable system with low exposure may be less urgent than a moderate flaw with live exploitation and easy chaining into privilege escalation. In practice, exploitability is the signal that converts a vulnerability from backlog item to containment priority.

Practical implication: build patch queues around exploit evidence and exposure, not severity alone.

How privilege escalation and code execution alter control boundaries

The article highlights two common failure modes. First, privilege escalation to SYSTEM collapses endpoint trust because the attacker inherits the highest local authority. Second, code execution through developer tooling or script handling turns normal workflows into execution paths, which means user context becomes the control boundary. Once execution happens under a trusted user or service account, downstream access can extend into code, data, or administrative interfaces. These are identity-adjacent failures because they convert a software flaw into authenticated control loss.

Practical implication: treat local admin and scripting permissions as part of your identity risk model.

What EPSS volatility means for remediation governance

EPSS is not a replacement for human judgement, but it is a useful probability signal that can change quickly as new exploit data arrives. Large score swings mean a vulnerability can move from low concern to near-term risk in days, especially when public exploit artefacts or attacker activity emerge. That creates a governance problem for static remediation calendars: if the score changes faster than your patch cycle, your queue is already stale. Risk teams need a process for re-ranking work continuously, not monthly.

Practical implication: recalculate remediation priority on a rolling basis whenever exploit signals change.

Threat narrative

Attacker objective: The attacker wants to turn a routine user, developer, or service workflow into high-privilege execution on the target system.

1. Entry begins when an attacker reaches an exposed endpoint or local user workflow that can process crafted content or packets.
2. Escalation occurs when a use-after-free, command injection, or parsing flaw converts that input into code execution or SYSTEM-level privileges.
3. Impact follows when the attacker runs arbitrary code with elevated authority, which can lead to endpoint takeover, lateral movement, or defensive control bypass.

Breaches seen in the wild

• Microsoft SAS Key Breach — Overly permissive Azure SAS token exposes 38TB of Microsoft internal data including secrets and credentials.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploitability, not severity, is the real patch governor: CVSS remains useful, but it is too static to carry operational priority on its own. When KEV listing, public disclosure, and EPSS movement all point in the same direction, remediation should move from backlog management to active risk containment. The practical conclusion is that vulnerability programmes need dynamic reprioritisation rules, not fixed patch calendars.

Privilege escalation is an identity problem once local authority becomes the attack outcome: A flaw that ends in SYSTEM access is not just an endpoint issue. It expands the attacker's ability to impersonate trusted processes, bypass local controls, and reach sensitive tooling or data. In that sense, local privilege boundaries are part of broader IAM and PAM governance, because they determine whether compromise stays isolated or becomes control-plane access.

AI-assisted developer tooling widens the trust boundary around code execution: The Copilot for JetBrains issue shows how auto-approved commands and embedded scripting can create execution without meaningful user review. That matters for agentic workflows too, because any system that executes instructions from trusted tooling must be governed as an identity-bearing runtime. Practitioners should treat developer assistants, script runners, and automation hooks as part of the access model.

EPSS volatility exposes remediation debt, not just model noise: A queue that cannot absorb rapid score changes is already behind the threat curve. The problem is not that probability models fluctuate, but that many teams still run static prioritisation processes against dynamic exploit data. The practical conclusion is that vulnerability governance must be able to reclassify risk continuously as new evidence arrives.

Execution trust gap: This article exposes a recurring failure mode where trusted endpoints, scripts, and developer tools are allowed to execute unapproved actions without sufficient control separation. That gap sits at the intersection of endpoint security, privileged access, and identity governance, because the attacker gains not just code execution but legitimate runtime authority. The practical conclusion is to narrow which identities can invoke high-risk execution paths.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• From our research: Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
• Forward look: Explore Ultimate Guide to NHIs , Key Challenges and Risks for the lifecycle gaps that make rapid remediation difficult.

What this signals

Execution trust gap: December’s patch set is another reminder that privilege escalation and code execution are not purely endpoint issues. When a vulnerability can turn a normal workflow into SYSTEM authority or unreviewed script execution, the remediation programme has to include identity, privileged access, and application control decisions together. Teams that separate these functions will keep missing how attacker authority actually expands.

The operational signal is clear: dynamic exploit scoring now needs to sit inside vulnerability governance, not beside it. If remediation queues do not change when KEV status or EPSS shifts, the organisation is relying on stale prioritisation at the exact moment attackers are adjusting. That is a resilience problem as much as a security problem.

For practitioners

• Re-rank patches using exploit evidence Prioritise CVEs that combine KEV listing, public exploit artefacts, and EPSS movement, then route them ahead of severity-only backlog items. Use a daily triage loop for systems that sit near admin, developer, or network-perimeter functions.
• Restrict high-risk execution paths Limit who can use PowerShell, developer automation, and other script-executing tools on endpoints that handle sensitive administration or code. Pair least privilege with application control so unapproved commands cannot run under trusted user context.
• Treat local privilege as identity scope Map where SYSTEM, local admin, and service-account permissions can be reached from normal user workflows, then reduce those pathways before attackers can chain exploitation into broader access. Review endpoints that support VPN, sync, or developer functions first.
• Refresh remediation triggers when EPSS shifts Recalculate priority whenever EPSS changes materially, especially when a CVE moves into a high percentile band. If your toolchain does not surface score changes quickly, create a manual exception review for top-risk assets.
• Tighten developer-tool trust assumptions Review auto-approval, command chaining, and plugin permissions in IDEs and AI-assisted tooling. Where automatic execution is unavoidable, isolate those endpoints and require stronger controls around code signing, update trust, and user approval boundaries.

Key takeaways

• December’s Patch Tuesday shows that active exploitation and privilege escalation should outweigh raw severity when patch queues are built.
• EPSS volatility can move thousands of CVEs at once, so vulnerability governance needs continuous reprioritisation rather than static monthly cycles.
• Developer tools, scripting paths, and local privilege boundaries now deserve identity-style governance because they can become execution and escalation channels.

Key terms

• Exploitability signal: Any indicator that a vulnerability is likely to be used soon or is already being used, such as exploitability ratings, proof-of-concept code, or catalog membership. These signals help convert a long vulnerability list into a shorter response queue.
• Privilege Escalation: An attack technique where a compromised identity — often an NHI with initially limited permissions — exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• Endpoint Trust Boundary: The part of the security model where a device is treated as sufficiently trusted to hold or use sensitive data locally. For offline vault access, the endpoint becomes part of the identity control plane, so device loss, reassignment, and malware risk all matter.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• Per-CVE breakdown of the December Patch Tuesday list, including the three zero-days and the driver-level escalation path behind CVE-2025-62221.
• The article's own prioritisation rationale for the Critical RCE issues, which is useful when patch windows are constrained.
• EPSS movement tables and score-change examples that help teams compare exploit likelihood across a large vulnerability set.
• Specific commentary on why Microsoft’s warning for PowerShell matters for day-to-day admin and scripting workflows.

👉 Expel’s full post covers the per-CVE breakdown, exploitability signals, and patch-order context in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps security practitioners connect remediation, privilege, and access controls to the broader identity programme.