Microsoft June 2025 Patch Tuesday exposes identity-first cloud risk

At a glance

What this is: This analysis breaks down Microsoft’s June 2025 Patch Tuesday and shows how cloud RCEs, Active Directory privilege escalation and Office flaws converge into identity-first risk.

Why it matters: It matters because IAM teams cannot treat patching as a separate infrastructure task when exploitable code paths reach domain control, Kerberos infrastructure and tenant data access.

By the numbers:

• Microsoft’s June 2025 Patch Tuesday update has covered 66 vulnerabilities, including one actively exploited bug.

👉 Read Unosecur’s analysis of Microsoft’s June 2025 Patch Tuesday and identity-first cloud risk

Context

Microsoft’s June 2025 Patch Tuesday highlights a patch-management problem that is also an identity-governance problem. When unauthenticated remote code execution, privilege escalation and protocol abuse touch SharePoint, Schannel, KDC Proxy, Netlogon and Office apps, the blast radius can move from a single endpoint into cloud identity, domain control and tenant-wide access.

For IAM and security teams, the key issue is not just whether patches exist, but whether identity pathways are hardened enough to withstand delayed remediation. The article also points to architectural exposure such as BadSuccessor, where configuration and privilege design matter as much as the CVE itself.

Key questions

Q: What breaks when SharePoint or WebDAV flaws can reach identity infrastructure?

A: The break point is the assumption that application compromise stays inside the application layer. When code execution can reach authentication systems, attackers can pivot into tokens, sessions and directory access. At that point, patching becomes an identity containment problem as much as a vulnerability-management task.

Q: Why do Netlogon and KDC Proxy flaws matter more than ordinary server bugs?

A: They matter because they sit inside the trust fabric that governs authentication. If an attacker can abuse those services, they can influence who is trusted, what credentials are accepted, and which systems receive valid authentication material. In practice, this turns a technical vulnerability into a directory governance problem.

Q: How can security teams tell whether a patch programme is actually working?

A: A patch programme is working when installation success is confirmed across the full estate, exploited vulnerabilities are cleared first, and exceptions are measured rather than hidden. Strong programmes report by deployment state, not ticket completion, and they can explain which high-risk services remain exposed after each cycle.

Q: When should organisations prioritise identity-path bugs over other critical patches?

A: They should do so whenever the issue can touch authentication, privilege escalation or tenant-wide access. A flaw that can move into Kerberos, Netlogon or cloud identity infrastructure deserves earlier treatment than a similarly rated bug with a narrower containment boundary.

Technical breakdown

How patchable code flaws reach identity infrastructure

Remote code execution in services such as SharePoint, Schannel and WebDAV gives an attacker a foothold inside trusted enterprise pathways. Once code runs in that context, the problem is no longer only application compromise. It becomes an identity problem because the same compromised host can sit in front of Kerberos, directory services or cloud management planes. In hybrid environments, the path from code execution to identity access is short when authentication controls assume the caller is already trusted or already internal. That is why code fixes and identity hardening have to be treated as one control surface, not separate workstreams.

Practical implication: Treat internet-facing RCE issues as identity events when they sit near SSO, directory or mailbox access paths.

Why Netlogon and KDC Proxy matter for IAM controls

Netlogon and KDC Proxy are not ordinary application components. They sit in the authentication path, which means exploitation can move from initial foothold to privilege escalation, ticket abuse or impersonation of higher-value identities. In practical terms, these services help translate a technical exploit into authenticated reach across Active Directory and connected Microsoft services. When they fail, the attacker does not need to invent a new identity. They inherit one through the trust model. That is why these issues are especially dangerous in environments that still rely on broad domain trust and weak segmentation between directory tiers.

Practical implication: Prioritise identity-path controls around Netlogon and KDC Proxy before you normalise the rest of the patch queue.

What BadSuccessor reveals about privilege design

BadSuccessor is a useful reminder that some identity risks are architectural rather than purely vulnerability-driven. The flaw allows privilege escalation through existing permissions in Windows Server 2025 without modifying the target object, which means the attack path depends on how Active Directory rights are delegated in the first place. Akamai Technologies found that 91% of assessed environments gave non-administrative users the permissions needed to perform the attack, showing how a supposedly specialised weakness becomes common in real deployments. The lesson is that privilege design can create exploitable conditions even before an attacker arrives.

Practical implication: Review delegated rights and directory permissions as if they are part of the attack surface, not just administrative housekeeping.

Threat narrative

Attacker objective: The attacker wants to move from one exploitable service into directory-level control and then use that position to steal credentials, impersonate users and expand access across the tenant.

1. Initial access begins with a crafted SharePoint request, Schannel packet, WebDAV call or other exposed service that can execute code in a trusted environment.
2. Privilege escalation follows when Netlogon, KDC Proxy or Windows Installer weaknesses turn that foothold into higher-level directory or SYSTEM control.
3. Credential abuse then lets the attacker mint Kerberos tickets, read Entra ID tokens or reach Office 365 mailboxes and SharePoint libraries.
4. Impact becomes tenant-wide or domain-wide compromise, with persistent unauthorized access and credential theft across hybrid Microsoft environments.

Breaches seen in the wild

• ASP.NET machine key attacks 2025: Developers copied ASP.NET machine keys from public sources; attackers used one to run Godzilla via ViewState. Microsoft found 3,000+ such keys.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch speed is now an identity control, not just a vulnerability metric. Microsoft’s June 2025 Patch Tuesday shows that RCE and EoP flaws only tell part of the story when the affected services are tied to authentication, directory trust and tenant access. Once exploitation can reach Kerberos, Netlogon or Office 365 data paths, the remediation question becomes whether identity controls can contain the window before privilege is converted into reach.

Identity-first cloud risk is the convergence point, not a side effect. SharePoint, Schannel and WebDAV are not isolated application concerns when they can be used to pivot into cloud sessions, mailboxes and directory services. The relevant governance problem is blast radius across identity planes. Practitioners should stop reading patch bulletins as application-only inventories and start mapping them to access paths, trust boundaries and administrative privilege.

BadSuccessor exposes a governance assumption about delegation. The assumption that non-administrative permissions are too limited to become dangerous was designed for stable directory boundaries and clearly separated admin roles. That assumption fails when delegated rights are broad enough to enable privilege escalation without touching the target object. The implication is that directory delegation now needs the same scrutiny as any externally exposed attack surface.

Active Directory trust relationships are the real control boundary. The critical issue is not whether a given CVE is labelled Critical or Important, but whether it sits inside the trust fabric that turns a low-level exploit into high-value identity control. Netlogon, KDC Proxy and related services should be governed as access infrastructure, not as ordinary Windows components. Practitioners need to align patch priorities with the identities and privileges each service can expose.

The named concept here is identity blast radius. This patch cycle demonstrates how quickly a single unpatched service can expand from endpoint compromise into tenant compromise when identity paths remain broad and under-segmented. The more identity and application layers share trust assumptions, the larger the blast radius becomes. Security teams should measure remediation by how much access is prevented, not only by how many CVEs are closed.

What this signals

Identity blast radius: Patch backlogs matter most when a vulnerability can jump from an exposed service into authentication, token issuance or tenant-wide access. In those cases, the security question is not whether the patch exists, but how much privilege the attacker can inherit before the fix lands.

Microsoft’s June patch cycle reinforces that identity teams need service-by-service trust mapping, not just CVE triage. A flaw that reaches Netlogon, KDC Proxy or directory permissions should trigger control review across delegation, segmentation and emergency remediation paths.

For practitioners

• Map every June Patch Tuesday issue to an identity path Classify each affected service by whether it can reach directory services, token issuance, mailboxes or tenant admin paths. Put the highest urgency on flaws that can cross from code execution into authentication or privilege control.
• Prioritise Netlogon and KDC Proxy remediation first Treat the authentication services as high-value control points and patch or mitigate them before lower-value application issues. If these pathways stay exposed, compromise can turn into impersonation and domain-level reach.
• Reduce delegated rights that enable privilege escalation Review non-administrative permissions that can be chained into administrative impact, especially in Windows Server 2025 and Active Directory environments. Remove rights that are unnecessary for the current operating model.
• Disable unused attack surfaces such as WebDAV Where a service is not required, remove it rather than relying on patching alone. Unused exposed interfaces widen the entry surface for unauthenticated RCE and reduce the margin for delayed remediation.
• Track TPV against MTTR for identity-critical fixes Use Time to Patch Vulnerabilities and Mean Time to Remediate together so the business can see whether critical identity-path flaws are being closed before attackers can operationalise them.

Key takeaways

• This patch cycle is a reminder that application vulnerabilities become far more dangerous when they sit on paths into directory services, tokens and tenant access.
• The highest-risk issues here are the ones that can convert unauthenticated entry into privilege escalation or authenticated identity abuse.
• Practitioners should treat identity-path exposure, not just vulnerability count, as the deciding factor in remediation priority.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Authentication path: An authentication path is the route an identity uses to prove itself to a system, such as interactive login, LDAP bind, Kerberos ticket use, or service-to-service access. Many enterprises secure the credential but forget to govern every path that can still accept that identity.
• Delegated Privilege: Delegated privilege is access granted to a tool or system so it can perform actions without direct human intervention. The risk rises when delegation is broad, hidden, or hard to revoke, because the delegated actor can continue operating after trust has changed.
• Time To Patch Vulnerabilities: Time to Patch Vulnerabilities is the period between a vendor disclosure or fix release and full deployment in the environment. In identity-sensitive systems, it defines how long attackers may keep exploiting a known flaw to reach credentials, sessions, or privileged control paths.

What's in the full analysis

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• The article’s full CVE-by-CVE breakdown across SharePoint, Schannel, KDC Proxy, Netlogon and Office apps.
• The specific mitigation checklist for WebDAV, Netlogon Secure RPC, dMSA creation and storage-provider exposure.
• The platform workflow for quarantining risky accounts and writing actions to an immutable audit log.
• The TPV-versus-MTTR framing used to compare patch speed with incident containment speed.

👉 The full Unosecur post covers the CVE list, mitigation priorities and patch-versus-remediation timing.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.