# Microsoft Patch Tuesday December 2025 multiple critical RCE

Published: 2026-06-09 · Severity: routine · Sectors: government-national, technology, financial-services, healthcare, education
Canonical: https://vorant.io/reports/c983feaf-af4c-5f18-84be-2a86fb0c8786/microsoft-patch-tuesday-december-2025-multiple-critical-rce

> Microsoft released patches for multiple critical RCE vulnerabilities across Windows, Office, Exchange and other products; no active exploitation reported.

CIS MS-ISAC advisory 2025-113 documents a set of critical vulnerabilities in Microsoft products released on December 9, 2025. The most severe issues could allow remote code execution, granting attackers the privileges of the logged-on user. Affected products span a broad range including Windows core components (PowerShell, Win32K, Hyper-V, storage and file system drivers), Microsoft Office suite (Excel, Word, Outlook, Access, SharePoint), Microsoft Exchange Server, Azure Monitor Agent, Microsoft Edge for iOS, and Microsoft Copilot. The advisory notes no evidence of active exploitation in the wild at the time of publication. Defenders should apply Microsoft's patches immediately after testing, prioritize systems running with administrative privileges (which face greater risk), and enforce the principle of least privilege across the estate. CIS recommends establishing formal vulnerability management and remediation processes, conducting vulnerability scans and penetration testing, enabling exploit protection features, and implementing network segmentation to limit lateral movement if exploitation occurs.

## Detection guidance (public sample)

### Office Application Spawning Command Interpreter or Script Host

ATT&CK: T1203

Word, Excel, PowerPoint, Outlook or Access spawning a shell or script host, a common post-exploitation pattern for Office client-side RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Command Interpreter or Script Host
id: 7b42ef50-df8b-5ff9-be2e-3d884531cbaf
status: experimental
description: Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook,
  Access) spawning a command interpreter or script host. This is typical of successful
  exploitation of Office client-side remote code execution vulnerabilities, where
  the attacker gains the privileges of the logged-on user. Matches the parent/child
  relation, not any specific exploit artefact.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSACCESS.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Legitimate Office macros or add-ins that call cmd.exe or PowerShell for business
  automation
- Document management plugins launching helper scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-december-9-2025_2025-113
```

### IIS Worker Process Spawning Shell on Exchange or SharePoint Servers

ATT&CK: T1190

w3wp.exe spawning cmd, PowerShell or LOLBins, indicating possible exploitation of a public-facing Exchange/SharePoint/IIS application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell on Exchange or SharePoint Servers
id: 34ff5c48-179f-58c3-b832-15caf942aa75
status: experimental
description: Detects the IIS worker process w3wp.exe spawning a command interpreter
  or download-capable LOLBin. This is a typical outcome of remote code execution against
  public-facing web applications such as Exchange or SharePoint. Matches the parent/child
  relation, not any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Web applications that intentionally shell out to cmd.exe for administration or reporting
  tasks
- Exchange or SharePoint management and health scripts invoked from an IIS app pool
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-december-9-2025_2025-113
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-december-9-2025_2025-113

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c983feaf-af4c-5f18-84be-2a86fb0c8786/microsoft-patch-tuesday-december-2025-multiple-critical-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup