Microsoft has released security updates to address vulnerabilities in its software products, including, but not limited to:

• Windows OS: 10 and 11.

• Windows Server: 2016, 2019, 2022, 2025.

• Microsoft Office: 2016, 2019, and Microsoft Edge.

• Microsoft Project: 2016

• Microsoft Visual Studio – multiple versions

The released security updates fix several vulnerabilities, including critical and zero-day flaws that have been actively exploited. Key fixes include CVE-2025-21333, CVE-2025-21334, and CVE-2025-21335.

Security Risks

Identified vulnerabilities in Microsoft products can be exploited by authenticated attackers, enabling them to remotely take control of vulnerable systems and execute malicious code with elevated privileges. For a complete list of the security patches released by Microsoft, please refer to the Microsoft Security Update Guide and apply the necessary updates.

 Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and administrators:

1. Apply the latest security patches, as soon as possible, to prevent unauthorized control over unpatched systems.

2. Upgrade immediately to the latest supported version of installed Microsoft software in order to continue receiving technical support and security patches.

The following Microsoft software products reached their end-of-life and need to be upgraded immediately:

• Windows Vista, XP, 8 and 7

• Windows Server 2003, 2003 RE, 2008, 2008 RE, 2008 SP2, 2012 and 2012 R2

• Exchange Server 2003, 2007, 2010, 2013

• Microsoft SQL Server 2005, 2008, 2012

• Microsoft Office 2013

3. Before any updating task, ensure you have a current tested backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailing rwcsirt@ncsa.gov.rw or calling us on 9009.

References

• Release Note –January 2025.

• Microsoft Security Update Guide