Fortra Patch Priority Index for May 2025

Fortra's May 2025 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google.

Up first on the list are patches for Microsoft Edge (Chromium-based) and Google Chromium that resolve 6 issues including spoofing, out of bounds memory access, insufficient data validation, inappropriate implementation, use after free, and heap buffer overflow vulnerabilities.

Next on the list are patches for Microsoft Office, Excel, PowerPoint, and Outlook. These patches resolve 12 remote code execution vulnerabilities.

Up next are two patches for Microsoft Defender that resolve elevation of privilege and spoofing vulnerabilities.

Next are patches that affect components of the core Windows operating system. These patches resolve over 35 vulnerabilities, including elevation of privilege, denial of service, information disclosure, and remote code execution vulnerabilities. These vulnerabilities affect Kernel, NTFS, DWM Core Library, Remote Desktop Client, Routing and Remote Access Service (RRAS), CLFS, Virtual Machine Bus, Installer, Media, PRC, SMB, and various others.

Next there is a patch for Microsoft Power Apps that resolves an information disclosure vulnerability.

Up next are patches for .NET, Visual Studio, Visual Studio Code, Visual Studio, and Visual Studio Tools that resolve remote code execution, information disclosure, spoofing, and security feature bypass vulnerabilities.

Lastly, administrators should focus on server-side patches for Active Directory Certificate Services (AD CS), SharePoint, Hyper-V, Azure DevOps, Remote Desktop Gateway Service, and LDAP. These patches resolve remote code execution, denial of service, and elevation of privilege vulnerabilities.